Horton

Re: BUG #18273: Incorrect memory access occurs when gist__int index is building on data containing 2^31-1

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: exclusion@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Date: 2024-01-07T19:42:39Z
Lists: pgsql-bugs 
PG Bug reporting form <noreply@postgresql.org> writes:
> As far as I can see, the loop for j shown below:
> Datum
> g_int_decompress(PG_FUNCTION_ARGS)
> {
> ...
> 	for (i = 0; i < lenin; i += 2)
> 		for (j = din[i]; j <= din[i + 1]; j++)
> 			if ((!i) || *(dr - 1) != j)
> 				*dr++ = j;
> overflows when dln[i] == dln[i+1] == 2147483647.

Yeah, you are right.  Probably the simplest fix is to widen j to
int64.  I see that somebody has already int64-ified g_int_compress
and internal_size (else we'd not get this far), but they missed this.

Will fix, thanks for report!

			regards, tom lane

Commits

  1. Fix integer-overflow problem in intarray's g_int_decompress().