Content-Type: multipart/mixed; boundary="------------iXUjEIJRWkB0pVINtqKBij3y"
Message-ID: <da453149-fa9e-67fc-fbce-80cca399bce5@gmail.com>
Date: Sat, 17 Jun 2023 17:00:00 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.2
Subject: Re: BUG #17950: Incorrect memory access in gtsvector_picksplit()
Content-Language: en-US
To: pgsql-bugs@lists.postgresql.org
References: <17950-6c80a8d2b94ec695@postgresql.org>
From: Alexander Lakhin <exclusion@gmail.com>
In-Reply-To: <17950-6c80a8d2b94ec695@postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/da453149-fa9e-67fc-fbce-80cca399bce5%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------iXUjEIJRWkB0pVINtqKBij3y
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

29.05.2023 23:00, PG Bug reporting form wrote:
> The following bug has been logged on the website:
>
> Bug reference:      17950

I managed to reduce the reproducer to the following:
CREATE TABLE tst(t tsvector);
INSERT INTO tst SELECT array_to_string(array(SELECT 'a' || x::text FROM generate_series(1, 125) x), ' ')::tsvector FROM 
generate_series(1, 3000);
INSERT INTO tst SELECT '' FROM generate_series(1, 100);
CREATE INDEX gistidx ON tst USING gist (t tsvector_ops(siglen=1));

(Sorry for the previous messy script.)

A trivial fix for the issue is attached.

BTW, when looking at the index contents (page 0) using pageinspect, I saw:
  itemoffset |    ctid     | itemlen | dead | keys
------------+-------------+---------+------+-----------------------------------
           1 | (367,65535) |      16 | f    | (a)=("0 true bits, 0 false bits")
           2 | (368,65535) |      16 | f    | (a)=("0 true bits, 0 false bits")
The text describing keys looks confusing, just as if siglen was 0, but it's
not the case.
This is explained by the code:
         int            siglen = GETSIGLEN(key);
         int            cnttrue = (ISALLTRUE(key)) ? SIGLENBIT(siglen) : sizebitvec(GETSIGN(key), siglen);

         sprintf(outbuf, SINGOUTSTR, cnttrue, (int) SIGLENBIT(siglen) - cnttrue);

When ISALLTRUE, the code tries to calculate bit count from siglen, but
siglen is 0 in this case.
So maybe fix it in passing too...

Best regards,
Alexander
--------------iXUjEIJRWkB0pVINtqKBij3y
Content-Type: text/x-patch; charset=UTF-8;
 name="v1-01-fix-gtsvector_picksplit.patch"
Content-Disposition: attachment;
 filename="v1-01-fix-gtsvector_picksplit.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC90c2dpc3RpZHguYyBiL3NyYy9i
YWNrZW5kL3V0aWxzL2FkdC90c2dpc3RpZHguYwppbmRleCBmMGNkMjg2NmZmLi4xMmE0MTEx
ZTk5IDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC91dGlscy9hZHQvdHNnaXN0aWR4LmMKKysr
IGIvc3JjL2JhY2tlbmQvdXRpbHMvYWR0L3RzZ2lzdGlkeC5jCkBAIC03MzAsNyArNzMwLDcg
QEAgZ3RzdmVjdG9yX3BpY2tzcGxpdChQR19GVU5DVElPTl9BUkdTKQogCQkJCXNpemVfYWxw
aGEgPSBTSUdMRU5CSVQoc2lnbGVuKSAtCiAJCQkJCXNpemViaXR2ZWMoKGNhY2hlW2pdLmFs
bGlzdHJ1ZSkgPwogCQkJCQkJCSAgIEdFVFNJR04oZGF0dW1fbCkgOgotCQkJCQkJCSAgIEdF
VFNJR04oY2FjaGVbal0uc2lnbiksCisJCQkJCQkJICAgY2FjaGVbal0uc2lnbiwKIAkJCQkJ
CQkgICBzaWdsZW4pOwogCQl9CiAJCWVsc2UKQEAgLTc0NCw3ICs3NDQsNyBAQCBndHN2ZWN0
b3JfcGlja3NwbGl0KFBHX0ZVTkNUSU9OX0FSR1MpCiAJCQkJc2l6ZV9iZXRhID0gU0lHTEVO
QklUKHNpZ2xlbikgLQogCQkJCQlzaXplYml0dmVjKChjYWNoZVtqXS5hbGxpc3RydWUpID8K
IAkJCQkJCQkgICBHRVRTSUdOKGRhdHVtX3IpIDoKLQkJCQkJCQkgICBHRVRTSUdOKGNhY2hl
W2pdLnNpZ24pLAorCQkJCQkJCSAgIGNhY2hlW2pdLnNpZ24sCiAJCQkJCQkJICAgc2lnbGVu
KTsKIAkJfQogCQllbHNlCg==
--------------iXUjEIJRWkB0pVINtqKBij3y
Content-Type: text/x-patch; charset=UTF-8; name="v1-02-fix-gtsvectorout.patch"
Content-Disposition: attachment; filename="v1-02-fix-gtsvectorout.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC90c2dpc3RpZHguYyBiL3NyYy9i
YWNrZW5kL3V0aWxzL2FkdC90c2dpc3RpZHguYwppbmRleCAxMmE0MTExZTk5Li4yNzIyYzAy
NDU3IDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC91dGlscy9hZHQvdHNnaXN0aWR4LmMKKysr
IGIvc3JjL2JhY2tlbmQvdXRpbHMvYWR0L3RzZ2lzdGlkeC5jCkBAIC0xMTUsMTAgKzExNSwx
NSBAQCBndHN2ZWN0b3JvdXQoUEdfRlVOQ1RJT05fQVJHUykKIAkJc3ByaW50ZihvdXRidWYs
IEFSUk9VVFNUUiwgKGludCkgQVJSTkVMRU0oa2V5KSk7CiAJZWxzZQogCXsKLQkJaW50CQkJ
c2lnbGVuID0gR0VUU0lHTEVOKGtleSk7Ci0JCWludAkJCWNudHRydWUgPSAoSVNBTExUUlVF
KGtleSkpID8gU0lHTEVOQklUKHNpZ2xlbikgOiBzaXplYml0dmVjKEdFVFNJR04oa2V5KSwg
c2lnbGVuKTsKKwkJaWYgKElTQUxMVFJVRShrZXkpKQorCQkJc3ByaW50ZihvdXRidWYsICJh
bGwgdHJ1ZSBiaXRzIik7CisJCWVsc2UKKwkJeworCQkJaW50CQkJc2lnbGVuID0gR0VUU0lH
TEVOKGtleSk7CisJCQlpbnQJCQljbnR0cnVlID0gKElTQUxMVFJVRShrZXkpKSA/IFNJR0xF
TkJJVChzaWdsZW4pIDogc2l6ZWJpdHZlYyhHRVRTSUdOKGtleSksIHNpZ2xlbik7CiAKLQkJ
c3ByaW50ZihvdXRidWYsIFNJTkdPVVRTVFIsIGNudHRydWUsIChpbnQpIFNJR0xFTkJJVChz
aWdsZW4pIC0gY250dHJ1ZSk7CisJCQlzcHJpbnRmKG91dGJ1ZiwgU0lOR09VVFNUUiwgY250
dHJ1ZSwgKGludCkgU0lHTEVOQklUKHNpZ2xlbikgLSBjbnR0cnVlKTsKKwkJfQogCX0KIAog
CVBHX0ZSRUVfSUZfQ09QWShrZXksIDApOwo=

--------------iXUjEIJRWkB0pVINtqKBij3y--