From: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: hstore: Rework module to use Size and {add,mul}_size for allocat
Date: Tue, 18 Aug 2026 04:44:52 +0000
Message-ID: <E1wwBgx-000000010ko-1nxP@gemulon.postgresql.org> (raw)
hstore: Rework module to use Size and {add,mul}_size for allocation sizes
hstore has been relying on a set of int/int32 to count the total length
of all the keys and values constructed, relying on the maximum values of
the arguments rather than proper bound checks. As proved in the
reported thread, these counters could overflow and wrap, leading to
incorrect allocations.
This commit replaces the int/int32 values with a set of Size values,
with add_size() and mul_size() in charge of checking for overflows when
constructing hstore values before doing any allocation.
The changes that matter in terms of the report are mostly in
hstore_io.c. hstore_compat.c is adjusted for consistency, to keep the
allocation maths uniform across the module.
This is an old bug. A backpatch should perhaps be done but I cannot get
excited about a change like that in stable branches.
Reported-by: Man Zeng <zengman@halodbtech.com>
Author: Tender Wang <tndrwang@gmail.com>
Author: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/CAHewXNmfD6-9MDxgpRfTzjVj0mhBw3JMoNOHeTiPOjZGhNzd=g@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/92e20d4a4382810a30bdb394473d6ee891edab73
Modified Files
--------------
contrib/hstore/hstore.h | 33 ++++++++++-------
contrib/hstore/hstore_compat.c | 29 +++++++--------
contrib/hstore/hstore_io.c | 60 +++++++++++++++++++++----------
contrib/hstore/hstore_op.c | 12 +++----
contrib/hstore/hstore_subs.c | 4 +--
contrib/hstore_plperl/hstore_plperl.c | 6 ++--
contrib/hstore_plpython/hstore_plpython.c | 6 ++--
7 files changed, 91 insertions(+), 59 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: hstore: Rework module to use Size and {add,mul}_size for allocat
In-Reply-To: <E1wwBgx-000000010ko-1nxP@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox