Horton

BUG #18240: Undefined behaviour in cash_mul_flt8() and friends

The Post Office <noreply@postgresql.org>

View thread View on postgr.es
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: exclusion@gmail.com
Date: 2023-12-11T06:00:02Z
Lists: pgsql-bugs 
The following bug has been logged on the website:

Bug reference:      18240
Logged by:          Alexander Lakhin
Email address:      exclusion@gmail.com
PostgreSQL version: 16.1
Operating system:   Ubuntu 22.04
Description:        

The following multiplication:
SELECT 1_000_000_000::money * 1_000_000_000::float8;

gives the incorrect result:
 -$92,233,720,368,547,758.08

UBSan detects undefined behaviour:
cash.c:669:11: runtime error: 1e+20 is outside the range of representable
values of type 'long'
    #0 0x55d66011b73a in cash_mul_flt8
.../src/backend/utils/adt/cash.c:669:11

The same is observed with float4:
cash.c:719:11: runtime error: 1e+20 is outside the range of representable
values of type 'long'
    #0 0x55f2adc46072 in cash_mul_flt4
.../src/backend/utils/adt/cash.c:719:11

And with float8 * money...

Reproduced on REL9_6_0 (but the defect is much older, AFAICS) .. HEAD.

Commits

  1. Add overflow checks to money type.

  2. Reduce dependency to money data type in main regression test suite