Horton

Re: [PATCH] bms_prev_member() can read beyond the end of the array of allocated words

David Rowley <dgrowleyml@gmail.com>

View thread View on postgr.es
From: David Rowley <dgrowleyml@gmail.com>
To: Greg Burd <greg@burd.me>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2025-08-14T14:49:18Z
Lists: pgsql-hackers 
On Fri, 15 Aug 2025 at 02:21, Greg Burd <greg@burd.me> wrote:
> I found this too, and also the "one above" part seemed wrong to me as well.

It is valid to pass prevbit as a->nwords * BITS_PER_BITMAPWORD as the
code does "prevbit--;". Maybe it would be less confusing if it were
written as:

 * "prevbit" must be less than or equal to "a->nwords * BITS_PER_BITMAPWORD".

The Assert should be using <= rather than <.

David

Commits

  1. Add Asserts to validate prevbit values in bms_prev_member