Horton

Re: BUG #18247: Integer overflow leads to negative width

Richard Guo <guofenglinux@gmail.com>

View thread View on postgr.es
From: Richard Guo <guofenglinux@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: rekgrpth@gmail.com, pgsql-bugs@lists.postgresql.org
Date: 2023-12-15T02:28:10Z
Lists: pgsql-bugs

Attachments

On Thu, Dec 14, 2023 at 10:43 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:

> Richard Guo <guofenglinux@gmail.com> writes:
> > On Thu, Dec 14, 2023 at 5:29 PM PG Bug reporting form <
> > noreply@postgresql.org> wrote:
> >> EXPLAIN SELECT * FROM t;
> >> QUERY PLAN
> >> ------------------------------------------------------------
> >> Seq Scan on t  (cost=0.00..10.00 rows=1 width=-2113929008)
> >> (1 row)
>
> > Can we just error out when an overflow occurs?
>
> Probably better to clamp tuple width estimates to MaxAllocSize.
> Anything larger would not correspond to reality anyhow.


Fair point.  How about the attached patch?

Thanks
Richard

Commits

  1. Prevent integer overflow when forming tuple width estimates.

  2. compute_bitmap_pages' loop_count parameter should be double not int.