Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wXqqM-003W8X-2M for pgsql-committers@arkaria.postgresql.org; Fri, 12 Jun 2026 01:37:59 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wXqqL-0009lj-1u for pgsql-committers@arkaria.postgresql.org; Fri, 12 Jun 2026 01:37:57 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wXqqL-0009lZ-1A for pgsql-committers@lists.postgresql.org; Fri, 12 Jun 2026 01:37:57 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wXqqJ-00000002e4O-0Gui for pgsql-committers@lists.postgresql.org; Fri, 12 Jun 2026 01:37:57 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Date:Message-Id:Subject:To:From:MIME-Version: Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=H6nwG0OiSL73AzA28/cBnVOqwb2zMXTWXtdO9hukvaw=; b=IPPCU40wHrMd55XS6SxgobOc3e BGwP2khSQAeiIlQPlULsMcv5ZpB0CFeJgrjXdEADr7enyHRfFQ/R1qL3J0dYDePoaJDZalgiCl5aL ui4ff392fBRPN8HXdoywBeveKLzm/o1RN5YnztZq+mQhSdYsaMWuChxz1+bURSuC1s10W29SmYX95 5+eni+sC5ZkMGvN+8wZ2RxYaJzLJ/+miySbRPxOnURMxT+YeXy81fblsV/jOzZsMoOtdf+BjSJAY4 kSx6PNlPMwZYfwBCRMOcag7HJLkTmB2tMWmmb/OwnR2RnTm4z+Nn3e8b2v1CuSb6T7uPBKEl6R0vy y87CjNDw==; Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wXqqH-007KC0-2R for pgsql-committers@lists.postgresql.org; Fri, 12 Jun 2026 01:37:53 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wXqqH-0025Ye-21 for pgsql-committers@lists.postgresql.org; Fri, 12 Jun 2026 01:37:53 +0000 Content-Type: multipart/mixed; boundary="===============6690592291911615501==" MIME-Version: 1.0 From: Amit Langote To: pgsql-committers@lists.postgresql.org Subject: pgsql: Fix out-of-bounds write in RI fast-path batch on re-entry X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Fri, 12 Jun 2026 01:37:53 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============6690592291911615501== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Rml4IG91dC1vZi1ib3VuZHMgd3JpdGUgaW4gUkkgZmFzdC1wYXRoIGJhdGNoIG9uIHJlLWVudHJ5 CgpUaGUgRksgZmFzdC1wYXRoIGJhdGNoaW5nIGFkZGVkIGluIGI3YjI3ZWI0MWE1IHdyb3RlIHRo ZSBpbmNvbWluZyByb3cKaW50byB0aGUgYmF0Y2ggYXJyYXkgYmVmb3JlIGNoZWNraW5nIHdoZXRo ZXIgdGhlIGFycmF5IHdhcyBmdWxsOgoKICAgIGZwZW50cnktPmJhdGNoW2ZwZW50cnktPmJhdGNo X2NvdW50XSA9IEV4ZWNDb3B5U2xvdEhlYXBUdXBsZShuZXdzbG90KTsKICAgIGZwZW50cnktPmJh dGNoX2NvdW50Kys7CiAgICBpZiAoZnBlbnRyeS0+YmF0Y2hfY291bnQgPj0gUklfRkFTVFBBVEhf QkFUQ0hfU0laRSkKICAgICAgICByaV9GYXN0UGF0aEJhdGNoRmx1c2goZnBlbnRyeSwgZmtfcmVs LCByaWluZm8pOwoKYmF0Y2hfY291bnQgaXMgcmVzZXQgdG8gemVybyBvbmx5IGF0IHRoZSBlbmQg b2YgcmlfRmFzdFBhdGhCYXRjaEZsdXNoKCksCnNvIGl0IHJlbWFpbnMgYXQgUklfRkFTVFBBVEhf QkFUQ0hfU0laRSB0aHJvdWdob3V0IGEgZnVsbC1iYXRjaCBmbHVzaC4KQSBmbHVzaCBydW5zIHVz ZXItZGVmaW5lZCBjYXN0IGZ1bmN0aW9ucyBhbmQgZXF1YWxpdHkgb3BlcmF0b3JzOyBpZiB0aGF0 CnVzZXIgY29kZSBwZXJmb3JtcyBETUwgb24gdGhlIHNhbWUgRksgdGFibGUsIHJpX0Zhc3RQYXRo QmF0Y2hBZGQoKQpyZS1lbnRlcnMgd2l0aCBiYXRjaF9jb3VudCA9PSBSSV9GQVNUUEFUSF9CQVRD SF9TSVpFIGFuZCB3cml0ZXMgb25lIHBhc3QKdGhlIGVuZCBvZiB0aGUgYXJyYXksIGNvcnJ1cHRp bmcgdGhlIGFkamFjZW50IGJhdGNoX2NvdW50IGZpZWxkLiAgVGhpcwppcyByZWFjaGFibGUgYnkg YW4gdW5wcml2aWxlZ2VkIHRhYmxlIG93bmVyIHZpYSBhbiBpbXBsaWNpdCBjYXN0IHdpdGggYQpQ TC9wZ1NRTCBmdW5jdGlvbiBhbmQgY2F1c2VzIGEgU0lHU0VHViBpbiBhc3NlcnQtZW5hYmxlZCBi dWlsZHMuCgpGaXggYnkgYm91bmRzLWNoZWNraW5nIHRoZSB3cml0ZSBpbnRvIHRoZSBiYXRjaCBh cnJheSBzbyBhIHJlLWVudHJhbnQKYWRkIGNhbiBuZXZlciB3cml0ZSBwYXN0IHRoZSBlbmQsIGFu ZCBieSBhZGRpbmcgYSAiZmx1c2hpbmciIGZsYWcgdG8KUklfRmFzdFBhdGhFbnRyeSB0aGF0IHJv dXRlcyByZS1lbnRyYW50IHJpX0Zhc3RQYXRoQmF0Y2hBZGQoKSBjYWxscyBvbgphIGJ1c3kgZW50 cnkgdG8gdGhlIHBlci1yb3cgcGF0aCAocmlfRmFzdFBhdGhDaGVjaykgaW5zdGVhZCBvZiB0b3Vj aGluZwp0aGUgbWlkLWZsdXNoIGJhdGNoIGFycmF5LiAgVGhlIGZsYWcgaXMgc2V0IGFyb3VuZCB0 aGUgcHJvYmUgaW4KcmlfRmFzdFBhdGhCYXRjaEZsdXNoKCkgYW5kIGNsZWFyZWQgaW4gYSBQR19G SU5BTExZLCB3aGljaCBhbHNvIHJlc2V0cwpiYXRjaF9jb3VudCwgc28gdGhlIGVudHJ5IGlzIGxl ZnQgZW1wdHkgYW5kIHJldXNhYmxlIGlmIGEgZmx1c2ggZXJyb3IKKGluY2x1ZGluZyBhIHJlcG9y dGVkIEZLIHZpb2xhdGlvbikgaXMgY2F1Z2h0IGJ5IGEgc2F2ZXBvaW50LgoKQWRkIHJlZ3Jlc3Np b24gdGVzdHMgZm9yIGJvdGggdGhlIHJlLWVudHJhbnQgZmx1c2ggYW5kIHJldXNlIG9mIGFuIGVu dHJ5CmFmdGVyIGEgZmx1c2ggZXJyb3IgY2F1Z2h0IGJ5IGEgc2F2ZXBvaW50LgoKUmVwb3J0ZWQt Ynk6IE5pa29sYXkgU2Ftb2todmFsb3YgPG5pa0Bwb3N0Z3Jlcy5haT4KUmV2aWV3ZWQtYnk6IE5p a29sYXkgU2Ftb2todmFsb3YgPG5pa0Bwb3N0Z3Jlcy5haT4KUmV2aWV3ZWQtYnk6IEF5dXNoIFRp d2FyaSA8YXl1c2h0aXdhcmkuc2xnMDFAZ21haWwuY29tPgpSZXZpZXdlZC1ieTogSnVud2FuZyBa aGFvIDx6aGp3cGt1QGdtYWlsLmNvbT4KRGlzY3Vzc2lvbjogaHR0cHM6Ly9wb3N0Z3IuZXMvbS9D QU01MjdkOWV4UkNkV3JoSk9uQXhrX3ZBQ2c3c3JfeVBvYUpwXyt1Q0ZZMHFQOHY9YXdAbWFpbC5n bWFpbC5jb20KCkJyYW5jaAotLS0tLS0KbWFzdGVyCgpEZXRhaWxzCi0tLS0tLS0KaHR0cHM6Ly9n aXQucG9zdGdyZXNxbC5vcmcvcGcvY29tbWl0ZGlmZi8wZTQ3YmI1ZmJlZWM2NGQ3NzZkNDlkZWUy NDJiYWMzOWQ0NjE2ZjhiCgpNb2RpZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmFja2Vu ZC91dGlscy9hZHQvcmlfdHJpZ2dlcnMuYyAgICAgICB8IDgwICsrKysrKysrKysrKysrKysrKysr KysrKy0tLS0tLS0Kc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9mb3JlaWduX2tleS5vdXQgfCA1 NiArKysrKysrKysrKysrKysrKysrKysrCnNyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2ZvcmVpZ25fa2V5 LnNxbCAgICAgIHwgNDYgKysrKysrKysrKysrKysrKysrCjMgZmlsZXMgY2hhbmdlZCwgMTY1IGlu c2VydGlvbnMoKyksIDE3IGRlbGV0aW9ucygtKQoK --===============6690592291911615501==--