agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: pg_surgery: Fix infinite loop on large TID arrays 7+ messages / 1 participants [nested] [flat]
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/346fbdcc2a92e86c7e964d637f8333c7b8197143 Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/1f24c823720dfbd6632383c8e8ba92a4b3bc0785 Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/19f0391df48202e2c6ac2e30a4c1c284aab5681b Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/1b6c99d96a9302d3aca7ef900e173a889e9700f9 Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/eb28b6f24b347985e61aa293bb4efc6c74a5765a Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/395700f48f25c00e1bbce01d3a67be2a28fe7c44 Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: pg_surgery: Fix infinite loop on large TID arrays @ 2026-08-04 09:47 Álvaro Herrera <alvherre@kurilemu.de> 0 siblings, 0 replies; 7+ messages in thread From: Álvaro Herrera @ 2026-08-04 09:47 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_surgery: Fix infinite loop on large TID arrays heap_force_common() tracked the current position in the caller-supplied tid[] using OffsetNumber, which is only 16 bits wide, so when the array held more than 65535 entries, the updated index wrapped around and the outer loop never reached the exit condition. A SQL call with a sufficiently large TID array would then run until interrupted. Fix by tracking the tid[] position using int instead of OffsetNumber. A regress case based on the report is included. Author: Andrey Rachitskiy <pl0h0yp1@gmail.com> Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru> Reported-by: Yuelin Wang <1217816127@qq.com> Backpatch-through: 14 Bug: #19607 Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e9d53cf459419cc7fd32dc85c59ee08ee5bbf1f4 Modified Files -------------- contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++ contrib/pg_surgery/heap_surgery.c | 6 +++--- contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2026-08-04 09:47 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de> 2026-08-04 09:47 pgsql: pg_surgery: Fix infinite loop on large TID arrays Álvaro Herrera <alvherre@kurilemu.de>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox