Message-ID: <ebbc2efb-7ef9-bf2f-1ada-d6ec48f70e58@postgrespro.ru>
Date: Fri, 13 May 2022 11:56:43 +0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.8.0
Content-Language: en-US
To: pgsql-bugs@lists.postgresql.org
From: Andrey Lepikhov <a.lepikhov@postgrespro.ru>
Subject: Negative value of numGroups
Organization: Postgres Professional
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/ebbc2efb-7ef9-bf2f-1ada-d6ec48f70e58%40postgrespro.ru>
Precedence: bulk

Hi,

Using sqlancer I've found curious vulnerability. In some places of the 
code we convert LONG_MAX to double. After value of 2^53 double doesn't 
correspond to a long value precisely. So, LONG_MAX can be converted into 
'LONG_MAX + 1' double value. And string:

(long) Min(numGroups, (double) LONG_MAX);

can return negative value, if numGroups > LONG_MAX.
Maybe it isn't practical issue right now, but this annoying thing 
doesn't allow to pass sqlancer tests sometimes, for example, with options:

--extensions='pg_stat_statements' --oracle HAVING

It is not difficult to fix the problem in-place, of course. But maybe do 
better: change the type of numGroups field in any Plan nodes to double 
and convert it into specific type right before usage?

-- 
Regards
Andrey Lepikhov
Postgres Professional