public inbox for [email protected]
help / color / mirror / Atom feedFrom: Oleg Tselebrovskiy <[email protected]>
To: [email protected]
Subject: BRIN integer overflow
Date: Wed, 21 Feb 2024 12:40:59 +0700
Message-ID: <[email protected]> (raw)
Greetings, everyone!
While analyzing output of Svace static analyzer [1] I've found a bug
Function bringetbitmap that is used in BRIN's IndexAmRoutine should
return an
int64 value, but the actual return value is int, since totalpages is int
and
totalpages * 10 is also int. This could lead to integer overflow
I suggest to change totalpages to be int64 to avoid potential overflow.
Also in all other "amgetbitmap functions" (such as hashgetbitmap,
gistgetbitmap,
gingetbitmap, blgetbitmap) the return value is of correct int64 type
The proposed patch is attached
[1] - https://svace.pages.ispras.ru/svace-website/en/
Oleg Tselebrovskiy, Postgres Pro
Attachments:
[text/x-diff] brin_integer_overflow_fix.patch (457B, ../[email protected]/2-brin_integer_overflow_fix.patch)
download | inline diff:
diff --git a/src/backend/access/brin/brin.c b/src/backend/access/brin/brin.c
index 1087a9011ea..f72667e484e 100644
--- a/src/backend/access/brin/brin.c
+++ b/src/backend/access/brin/brin.c
@@ -559,7 +559,7 @@ bringetbitmap(IndexScanDesc scan, TIDBitmap *tbm)
BrinOpaque *opaque;
BlockNumber nblocks;
BlockNumber heapBlk;
- int totalpages = 0;
+ int64 totalpages = 0;
FmgrInfo *consistentFn;
MemoryContext oldcxt;
MemoryContext perRangeCxt;
view thread (2+ messages)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected]
Subject: Re: BRIN integer overflow
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox