Feedback-ID: i0fe9450f:Fastmail
Date: Fri, 5 Jun 2026 15:57:06 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Ashutosh Sharma <ashu.coek88@gmail.com>
Cc: surya poondla <suryapoondla4@gmail.com>,
	"violin0613@tju.edu.cn" <violin0613@tju.edu.cn>,
	pgsql-bugs@postgresql.org
Subject: Re: Fw: Re: heap_force_common in contrib/pg_surgery/heap_surgery.c
 has an off by one stack buffer overflow
Message-ID: <aiJzQt3zRv7Dvm_4@paquier.xyz>
References: <20260604002256.40f1fd544@smtp.qiye.163.com>
 <CAOVWO5p-nQ2ki88uAUO5TNWNZDmX-ZZZmJ3307K0xnsg4q75rA@mail.gmail.com>
 <aiEpyJteDv3q-EMi@paquier.xyz>
 <CAE9k0P=sDshMaBDZzEfNPVo62w7PmnecKhtXX-Zn=AzeQ3k5kA@mail.gmail.com>
 <aiIHe-G6Kg1fXbeb@paquier.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="CYrCQLubYtid4IRR"
Content-Disposition: inline
In-Reply-To: <aiIHe-G6Kg1fXbeb@paquier.xyz>
Archived-At: 
 <https://www.postgresql.org/message-id/aiJzQt3zRv7Dvm_4%40paquier.xyz>
Precedence: bulk


--CYrCQLubYtid4IRR
Content-Type: multipart/mixed; boundary="hKqD4QVMmlm3nny4"
Content-Disposition: inline


--hKqD4QVMmlm3nny4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Jun 05, 2026 at 08:17:15AM +0900, Michael Paquier wrote:
> At the end, the first pattern is an outlier, we don't need to worry
> about performance in pg_surgery, and we're talking about three lines
> of code in pg_surgery to change (two for include_this_tid, one for the
> assertion).  With all that in mind, I'd just do a -1 conversion and
> call it a day.  :)

Which implies something like the simpler patch attached.
--
Michael

--hKqD4QVMmlm3nny4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=surgery-oneoff.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/contrib/pg_surgery/heap_surgery.c b/contrib/pg_surgery/heap_su=
rgery.c
index ae4e7c0136cc..6a92d2bd5fec 100644
--- a/contrib/pg_surgery/heap_surgery.c
+++ b/contrib/pg_surgery/heap_surgery.c
@@ -228,8 +228,8 @@ heap_force_common(FunctionCallInfo fcinfo, HeapTupleFor=
ceOption heap_force_opt)
 			}
=20
 			/* Mark it for processing. */
-			Assert(offno < MaxHeapTuplesPerPage);
-			include_this_tid[offno] =3D true;
+			Assert((offno - 1) < MaxHeapTuplesPerPage);
+			include_this_tid[offno - 1] =3D true;
 		}
=20
 		/*
@@ -247,7 +247,7 @@ heap_force_common(FunctionCallInfo fcinfo, HeapTupleFor=
ceOption heap_force_opt)
 		{
 			ItemId		itemid;
=20
-			if (!include_this_tid[curoff])
+			if (!include_this_tid[curoff - 1])
 				continue;
=20
 			itemid =3D PageGetItemId(page, curoff);

--hKqD4QVMmlm3nny4--

--CYrCQLubYtid4IRR
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmoic0IACgkQnvQgOdby
QH2IPw//RgTxTdEGH8g7bNbmyutRfiGDu6aYTLCSUoWUhtnRTxxYjej1WiCNvHFL
rAve94mlQxBkYrK41bJa4t+nruh/IylEwvAwh8GZI5t7qI31vWcqJVxJjpZSofh9
UxHbuvMOlPzRuWKrINEYLHeB5Wcw6zgrcpNDyiDU1Mmri4kLZ8k8cs/W2d3I/3gp
/dMZE/U4Q/onygL3XUkenqPQOuvXs5bo7JAx/lyS7gFOo4DHehQFsDwaaWg8RKaC
7/qFTbd/cY5nOkvTTwaIX1zRbrr/e3VYRbd+/WAyXXDklOKN4JB18cvFCyIfGHv1
8iG/j3FJdSK0Oglx2/c2OaS3bVmSbLqsso5YBqLe+LKH1BcTJF4MYrKLqDbXo9DD
ZFbJWZHY0yI9XUs5XyPmZbrb/0jVoLgNZRKl0xeNawd6etcNV8ky2Qla3maB88kz
Kewf28mJQUOeBmmBp7hgKfXQuPs19djXKH5nmsZXS5yR6V3867j+j28HF2/T1ghD
QqLNAedH4Z9PoiokyW2XxyxcMSThGZ0HN/B3QF+vjtPnx42EJcFKC0b2FRmAgzcy
iqk4WP/cDnyoBLenggLeyTtnxCcc1lU5+4qTxHSW5zHeKhXVU3HI3oIF3uPHZcdH
QZQoflWGhiLbUReSB8d8kQ6vhNnlzuSmvFHUFs/7AeUen8QJgUg=
=ViaZ
-----END PGP SIGNATURE-----

--CYrCQLubYtid4IRR--