agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix wrong variable offset sanity check. 6+ messages / 1 participants [nested] [flat]
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/323530e00d279f267265ef32c7e6b40a04c94105 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/64542957b44cce7e29f1979bcfbf04477234ea3c Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8af1f527842170a257ae0684dd02907135d8d2e5 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0cb713b120bab0255ac039972f4141d2993eeb79 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/656711398a6952b8d3258a337a06f85ec8dfabf6 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix wrong variable offset sanity check. @ 2026-07-16 22:57 Peter Geoghegan <pg@bowt.ie> 0 siblings, 0 replies; 6+ messages in thread From: Peter Geoghegan @ 2026-07-16 22:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <pg@bowt.ie> Reported-by: Konstantin Knizhnik <knizhnik@garret.ru> Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/aaad61f5f2700252bf9d51ae79ebbb2fdec8c0ac Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-07-16 22:57 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie> 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie> 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie> 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie> 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie> 2026-07-16 22:57 pgsql: Fix wrong variable offset sanity check. Peter Geoghegan <pg@bowt.ie>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox