agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Richard Guo <rguo@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix integer overflow in nodeWindowAgg.c
Date: Thu, 09 Apr 2026 10:37:34 +0000
Message-ID: <E1wAmlR-00087i-2G@gemulon.postgresql.org> (raw)
Fix integer overflow in nodeWindowAgg.c
In nodeWindowAgg.c, the calculations for frame start and end positions
in ROWS and GROUPS modes were performed using simple integer addition.
If a user-supplied offset was sufficiently large (close to INT64_MAX),
adding it to the current row or group index could cause a signed
integer overflow, wrapping the result to a negative number.
This led to incorrect behavior where frame boundaries that should have
extended indefinitely (or beyond the partition end) were treated as
falling at the first row, or where valid rows were incorrectly marked
as out-of-frame. Depending on the specific query and data, these
overflows can result in incorrect query results, execution errors, or
assertion failures.
To fix, use overflow-aware integer addition (ie, pg_add_s64_overflow)
to check for overflows during these additions. If an overflow is
detected, the boundary is now clamped to INT64_MAX. This ensures the
logic correctly treats the boundary as extending to the end of the
partition.
Bug: #19405
Reported-by: Alexander Lakhin <exclusion@gmail.com>
Author: Richard Guo <guofenglinux@gmail.com>
Reviewed-by: Tender Wang <tndrwang@gmail.com>
Discussion: https://postgr.es/m/19405-1ecf025dda171555@postgresql.org
Backpatch-through: 14
Branch
------
REL_14_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/305cf0df0c7834a23d5ee22c0560970bb66d68eb
Modified Files
--------------
src/backend/executor/nodeWindowAgg.c | 62 +++++++++++++++++++++---
src/test/regress/expected/window.out | 91 ++++++++++++++++++++++++++++++++++++
src/test/regress/sql/window.sql | 26 +++++++++++
3 files changed, 172 insertions(+), 7 deletions(-)
view thread (6+ messages)
Message-ID: <E1wAmlR-00087i-2G@gemulon.postgresql.org>
Permalink: ../E1wAmlR-00087i-2G@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wAmlR-00087i-2G@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: rguo@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix integer overflow in nodeWindowAgg.c
In-Reply-To: <E1wAmlR-00087i-2G@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox