Subject: pgsql: pg_surgery: Fix off-by-one bug with heap offset

From: Michael Paquier <[email-masked]>
Date: Fri, 05 Jun 2026 23:17:27 +0000

pg_surgery: Fix off-by-one bug with heap offset

heap_force_common() declared a boolean array indexed with an
OffsetNumber for a size of MaxHeapTuplesPerPage.  OffsetNumbers are
1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage
wrote one byte past the end of the stack array, crashing the server.

Like heapam_handler.c, this commit changes the array so as it uses a
0-based index, substracting one from the OffsetNumbers.

Reported-by: Wang Yuelin <[email-masked]>
Reviewed-by: Ashutosh Sharma <[email-masked]>
Discussion: https://postgr.es/m/[email-masked]
Backpatch-through: 14

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/daf8bc7d41acf0e4439ee137a6e9ae064a05de79

Modified Files
--------------
contrib/pg_surgery/heap_surgery.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)