agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Peter Geoghegan <pg@bowt.ie>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix wrong variable offset sanity check.
Date: Thu, 16 Jul 2026 22:57:36 +0000
Message-ID: <E1wkV1L-000X0U-0g@gemulon.postgresql.org> (raw)
Fix wrong variable offset sanity check.
Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three
places, but in heap_get_root_tuples it accidentally tested offnum -- the
outer loop variable, which is already bounded by the loop condition --
instead of nextoffnum, the offset actually passed to PageGetItemId. The
pre-c7aeb775 check tested nextoffnum.
With the check ineffective, a stale t_ctid could make PageGetItemId read
past the end of the line pointer array (which is data corruption that we
expect to be able to catch here).
Author: Peter Geoghegan <pg@bowt.ie>
Reported-by: Konstantin Knizhnik <knizhnik@garret.ru>
Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru
Backpatch-through: 15
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/aaad61f5f2700252bf9d51ae79ebbb2fdec8c0ac
Modified Files
--------------
src/backend/access/heap/pruneheap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
view thread (6+ messages)
Message-ID: <E1wkV1L-000X0U-0g@gemulon.postgresql.org>
Permalink: ../E1wkV1L-000X0U-0g@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wkV1L-000X0U-0g@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: pg@bowt.ie, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix wrong variable offset sanity check.
In-Reply-To: <E1wkV1L-000X0U-0g@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox