You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by le...@apache.org on 2026/09/29 13:22:16 UTC
(cloudberry) 26/50: Fix integer-overflow problem in intarray's g_int_decompress().
This is an automated email from the ASF dual-hosted git repository.
leborchuk pushed a commit to branch REL_2_STABLE
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit d19eec65b3b37896504ae7043061f905474004f9
Author: Tom Lane <tg...@sss.pgh.pa.us>
AuthorDate: Sun Jan 7 15:19:50 2024 -0500
Fix integer-overflow problem in intarray's g_int_decompress().
An array element equal to INT_MAX gave this code indigestion,
causing an infinite loop that surely ended in SIGSEGV. We fixed
some nearby problems awhile ago (cf 757c5182f) but missed this.
Report and diagnosis by Alexander Lakhin (bug #18273); patch by me
Discussion: https://postgr.es/m/18273-9a832d1da122600c@postgresql.org
(cherry picked from commit 90e8b86fc52a4be21aec16abfb5dccfb819cc53e)
---
contrib/intarray/_int_gist.c | 10 ++++++----
contrib/intarray/data/test__int.data | 1 +
contrib/intarray/expected/_int.out | 33 +++++++++++++++++----------------
contrib/intarray/sql/_int.sql | 5 +++--
4 files changed, 27 insertions(+), 22 deletions(-)
diff --git a/contrib/intarray/_int_gist.c b/contrib/intarray/_int_gist.c
index ea79c4bb51f..5d46b6bc13e 100644
--- a/contrib/intarray/_int_gist.c
+++ b/contrib/intarray/_int_gist.c
@@ -296,8 +296,7 @@ g_int_decompress(PG_FUNCTION_ARGS)
ArrayType *in;
int lenin;
int *din;
- int i,
- j;
+ int i;
in = DatumGetArrayTypeP(entry->key);
@@ -341,9 +340,12 @@ g_int_decompress(PG_FUNCTION_ARGS)
dr = ARRPTR(r);
for (i = 0; i < lenin; i += 2)
- for (j = din[i]; j <= din[i + 1]; j++)
+ {
+ /* use int64 for j in case din[i + 1] is INT_MAX */
+ for (int64 j = din[i]; j <= din[i + 1]; j++)
if ((!i) || *(dr - 1) != j)
- *dr++ = j;
+ *dr++ = (int) j;
+ }
if (in != (ArrayType *) DatumGetPointer(entry->key))
pfree(in);
diff --git a/contrib/intarray/data/test__int.data b/contrib/intarray/data/test__int.data
index b3903d0f33a..0a7fac3c087 100644
--- a/contrib/intarray/data/test__int.data
+++ b/contrib/intarray/data/test__int.data
@@ -6998,3 +6998,4 @@
{173,208,229}
{6,22,142,267,299}
{22,122,173,245,293}
+{1,2,101,102,201,202,2147483647}
diff --git a/contrib/intarray/expected/_int.out b/contrib/intarray/expected/_int.out
index b361d458912..db053812864 100644
--- a/contrib/intarray/expected/_int.out
+++ b/contrib/intarray/expected/_int.out
@@ -466,13 +466,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
SET enable_seqscan = off; -- not all of these would use index by default
@@ -540,13 +540,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
INSERT INTO test__int SELECT array(SELECT x FROM generate_series(1, 1001) x); -- should fail
@@ -622,13 +622,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
DROP INDEX text_idx;
@@ -702,13 +702,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
DROP INDEX text_idx;
@@ -776,13 +776,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
DROP INDEX text_idx;
@@ -850,13 +850,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from test__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
DROP INDEX text_idx;
@@ -872,9 +872,10 @@ DROP INDEX text_idx;
-- core that would reach the same codepaths.
CREATE TABLE more__int AS SELECT
-- Leave alone NULLs, empty arrays and the one row that we use to test
- -- equality
+ -- equality; also skip INT_MAX
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
- (select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000) from (select unnest(a) u) x)
+ (select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000)
+ from unnest(a) u where u < 2000000000)
END AS a, a as b
FROM test__int;
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
@@ -941,13 +942,13 @@ SELECT count(*) from more__int WHERE a @@ '(20&23)|(50&68)';
SELECT count(*) from more__int WHERE a @@ '20 | !21';
count
-------
- 6566
+ 6567
(1 row)
SELECT count(*) from more__int WHERE a @@ '!20 & !21';
count
-------
- 6343
+ 6344
(1 row)
RESET enable_seqscan;
diff --git a/contrib/intarray/sql/_int.sql b/contrib/intarray/sql/_int.sql
index 93004d374ad..ad210cf49f1 100644
--- a/contrib/intarray/sql/_int.sql
+++ b/contrib/intarray/sql/_int.sql
@@ -194,9 +194,10 @@ DROP INDEX text_idx;
-- core that would reach the same codepaths.
CREATE TABLE more__int AS SELECT
-- Leave alone NULLs, empty arrays and the one row that we use to test
- -- equality
+ -- equality; also skip INT_MAX
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
- (select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000) from (select unnest(a) u) x)
+ (select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000)
+ from unnest(a) u where u < 2000000000)
END AS a, a as b
FROM test__int;
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org