Re: Fix uninitialized PruneFreezeResult in pruneheap and vacuumlazy

Hi Chao Li,Hackers,


&gt; PruneFreezeResult presult; <== here presult is not initialized


&gt; &nbsp; const PruneFreezeResult *presult, <== presult is a const pointer, so prune_freeze_setup won’t update its content
&gt; &nbsp; PruneState *prstate)
&gt; {
&gt; &nbsp; &nbsp; prstate-&gt;deadoffsets = (OffsetNumber *) presult-&gt;deadoffsets; <== presult-&gt;deadoffsets could be a random value
&gt; }
&gt; ```


&gt; Attached is a simple fix by just initializing presult in the first place with {0}.&nbsp;


&nbsp; &nbsp; Initializing ’presult‘ under my operating system is very effective.
&nbsp; &nbsp; I have tested the change, and "make check" passed.




Best regards！


Feilong&nbsp;Meng
feelingmeng@foxmail.com

HighGo&nbsp;Software&nbsp;Co.,&nbsp;Ltd.


https://www.highgo.com/


        



         Original
         
       
From: Chao Li <li.evan.chao@gmail.com&gt;
Date: 2025-12-11 12:02
To: Postgres hackers <pgsql-hackers@lists.postgresql.org&gt;
Cc: Melanie Plageman <melanieplageman@gmail.com&gt;
Subject: Fix uninitialized PruneFreezeResult in pruneheap and vacuumlazy



Hi Hackers,

While reviewing Melanie's patch [1], I found this bug where presult is not initialized. Let me explain the logic.

In the first place:
```
static int
lazy_scan_prune(LVRelState *vacrel,
Buffer buf,
BlockNumber blkno,
Page page,
Buffer vmbuffer,
bool all_visible_according_to_vm,
bool *has_lpdead_items,
bool *vm_page_frozen)
{
Relation	rel = vacrel-&gt;rel;
PruneFreezeResult presult; <== here presult is not initialized


heap_page_prune_and_freeze(&amp;params,
&nbsp; &amp;presult, <== uninitialized presult is passed into&nbsp;heap_page_prune_and_freeze
&nbsp; &amp;vacrel-&gt;offnum,
&nbsp; &amp;vacrel-&gt;NewRelfrozenXid, &amp;vacrel-&gt;NewRelminMxid);
```


Then in&nbsp;heap_page_prune_and_freeze():
```
void
heap_page_prune_and_freeze(PruneFreezeParams *params,
&nbsp; PruneFreezeResult *presult,
&nbsp; OffsetNumber *off_loc,
&nbsp; TransactionId *new_relfrozen_xid,
&nbsp; MultiXactId *new_relmin_mxid)
{
Buffer		buffer = params-&gt;buffer;
Page		page = BufferGetPage(buffer);
PruneState	prstate;
bool		do_freeze;
bool		do_prune;
bool		do_hint_prune;
bool		did_tuple_hint_fpi;
int64		fpi_before = pgWalUsage.wal_fpi;


/* Initialize prstate */
prune_freeze_setup(params,
&nbsp; new_relfrozen_xid, new_relmin_mxid,
&nbsp; presult, &amp;prstate); <== immediately pass&nbsp;uninitialized presult to&nbsp;prune_freeze_setup
```


Then in&nbsp;prune_freeze_setup():
```
static void
prune_freeze_setup(PruneFreezeParams *params,
&nbsp; TransactionId *new_relfrozen_xid,
&nbsp; MultiXactId *new_relmin_mxid,
&nbsp; const PruneFreezeResult *presult, <== presult is a const pointer, so&nbsp;prune_freeze_setup won’t update its content
&nbsp; PruneState *prstate)
{
&nbsp; &nbsp; prstate-&gt;deadoffsets = (OffsetNumber *) presult-&gt;deadoffsets; <==&nbsp;presult-&gt;deadoffsets could be a random value
}
```


Attached is a simple fix by just initializing presult in the first place with {0}.&nbsp;


[1] https://postgr.es/m/CAAKRu_bvQiesumRhgvbcym1T9Z9=ddGfUbi-dSNxLRc6JvL1-w@mail.gmail.com


Best regards,
 --
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/