pg.ddx.io  pgsql-committers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Geoghegan <pg@bowt.ie>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix nbtree lookahead overflow bug.
Date: Mon, 26 Aug 2024 15:30:25 +0000
Message-ID: <E1sibfl-001aBk-Hv@gemulon.postgresql.org> (raw)

Fix nbtree lookahead overflow bug.

Add bounds checking to nbtree's lookahead/skip-within-a-page mechanism.
Otherwise it's possible for cases with lots of before-array-keys tuples
to overflow an int16 variable, causing the mechanism to generate an out
of bounds page offset number.

Oversight in commit 5bf748b8, which enhanced nbtree ScalarArrayOp
execution.

Reported-By: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/6c68ac42-bbb5-8b24-103e-af0e279c536f@gmail.com
Backpatch: 17-, where nbtree SAOP execution was enhanced.

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/09a8407dbfd848301cd2c9801c3b4d75adc6cabc

Modified Files
--------------
src/backend/access/nbtree/nbtutils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



view thread (2+ messages)  latest in thread

Message-ID: <E1sibfl-001aBk-Hv@gemulon.postgresql.org>
Permalink:  ../E1sibfl-001aBk-Hv@gemulon.postgresql.org/
Also on:    postgresql.org/message-id/E1sibfl-001aBk-Hv@gemulon.postgresql.org

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-committers@postgresql.org
  Cc: pg@bowt.ie, pgsql-committers@lists.postgresql.org
  Subject: Re: pgsql: Fix nbtree lookahead overflow bug.
  In-Reply-To: <E1sibfl-001aBk-Hv@gemulon.postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox