Feedback-ID: i0fe9450f:Fastmail
Date: Thu, 4 Jun 2026 16:31:20 +0900
From: Michael Paquier <michael@paquier.xyz>
To: surya poondla <suryapoondla4@gmail.com>
Cc: "violin0613@tju.edu.cn" <violin0613@tju.edu.cn>,
	pgsql-bugs@postgresql.org
Subject: Re: Fw: Re: heap_force_common in contrib/pg_surgery/heap_surgery.c
 has an off by one stack buffer overflow
Message-ID: <aiEpyJteDv3q-EMi@paquier.xyz>
References: <20260604002256.40f1fd544@smtp.qiye.163.com>
 <CAOVWO5p-nQ2ki88uAUO5TNWNZDmX-ZZZmJ3307K0xnsg4q75rA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="n7UFrlZz0LbqoKfr"
Content-Disposition: inline
In-Reply-To: 
 <CAOVWO5p-nQ2ki88uAUO5TNWNZDmX-ZZZmJ3307K0xnsg4q75rA@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/aiEpyJteDv3q-EMi%40paquier.xyz>
Precedence: bulk


--n7UFrlZz0LbqoKfr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Wed, Jun 03, 2026 at 03:31:27PM -0700, surya poondla wrote:
> Thank you for reporting the issue, I am able to reproduce it on master.
> The include_this_tid[] array is sized MaxHeapTuplesPerPage but indexed
> using 1-based OffsetNumber,
> so the largest legal offset (MaxHeapTuplesPerPage itself) lands one slot
> past the end.

-    bool        include_this_tid[MaxHeapTuplesPerPage];
+    /* Sized +1 because OffsetNumbers are 1-based and can reach MaxHeapTuplesPerPage. */
+    bool        include_this_tid[MaxHeapTuplesPerPage + 1];

The offset number begins at 1.  Hence, instead of making this array
larger by one, you could keep it at the same size and adjust the array
index to use (offno - 1) instead.
--
Michael

--n7UFrlZz0LbqoKfr
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmohKcgACgkQnvQgOdby
QH1+gQ//cIom383UaM28dAx4G/unq+MUJZZwHw1c66DY44tgkKA9LgHEbPpDv/Kq
T/c80gkkoQqIGHs08pwukJVOnrK3OunhSX5LGP1QqLMR5LLr4CGnEF2YV1oTlO9h
KygM+mKSUCu10G6ElrkCCAUjHMsorOAqoeD+tQHlwTnvb0LBhoXxsZ1VpLHMTOUU
cOflryG63BBbNXn/poJ/Fl7TUFLY3GKcceDwLsqLJkLUpj/NI7HGb5lHUDx8mNdb
rx/u0Ld1FVBITWbCkjXvwU7DNXXeHtbFjoDt5WW2y4BtgIB7ghr3vzty1NnMeskp
wqqwTaoF1hE7WDZxt5ycIPjCA9d/IO5m1H8NMWyx8gxVTNZbOBZFLYgTdsgqVfo5
wFUr1WgFXfgraYTgiaP0YMaGpbpc8nbU+AC1MqOsRGd+xHhKY7sOC6wGS4IV/0Ns
Vc9iKQUkRIH514Fj7eZwubq1UmbMBTv1bcRSqK4cqXaUGwgpdBI/I0ANIsp16kuI
c7WsQp5qlRQyVsl06hS3KcRhczVgS+Lu1qolQZnx+4uY3me5/IQkxmfuSZVhTMPG
4FTwx6PLDHjIRex8pOEj6KffPKLQEKpqjcAOJ/Hw6Fk6Hwt3iVLYhxtBg9W7gUv0
mSYchjN7OuNiVvIczQt+BrSwzRZZR18nMIx2B70j0ymzn4QhY00=
=OyEg
-----END PGP SIGNATURE-----

--n7UFrlZz0LbqoKfr--