Re: BUG #14722: Segfault in tuplesort_heap_siftup, 32 bit overflow

Peter Geoghegan <pg@bowt.ie>

From: Peter Geoghegan <pg@bowt.ie>

To: Heikki Linnakangas <hlinnaka@iki.fi>

Cc: Andres Freund <andres@anarazel.de>, Tom Lane <tgl@sss.pgh.pa.us>, Sergey Koposov <skoposov@cmu.edu>, "pgsql-bugs@postgresql.org" <pgsql-bugs@postgresql.org>

Date: 2017-07-12T17:44:33Z

Lists: pgsql-bugs

On Wed, Jul 12, 2017 at 10:42 AM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>> FWIW, memtupcount is allowed to go negative.
>
>
> Huh, say what?

Well, there are defenses against that case, both in assertions and in
code like tuplesort_heap_delete_top(). In that sense, it's allowed to
go negative.

-- 
Peter Geoghegan

Commits

Avoid integer overflow while sifting-up a heap in tuplesort.c.
- e439bbe9996f 9.4.13 landed
- e7213fe2bda8 9.5.8 landed
- 512f67c8d02c 10.0 landed
- 09c598898166 9.6.4 landed
Implement binary heap replace-top operation in a smarter way.
- 24598337c8d2 10.0 cited
Permit super-MaxAllocSize allocations with MemoryContextAllocHuge().
- 263865a48973 9.4.0 cited