Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit246693e

Browse files
committed
Fix possible internal overflow in numeric multiplication.
mul_var() postpones propagating carries until it risks overflow in itsinternal digit array. However, the logic failed to account for thepossibility of overflow in the carry propagation step, allowing wrongresults to be generated in corner cases. We must slightly reduce thewhen-to-propagate-carries threshold to avoid that.Discovered and fixed by Dean Rasheed, with small adjustments by me.This has been wrong since commitd72f6c7,so back-patch to all supported branches.
1 parent7f11724 commit246693e

File tree

3 files changed

+49
-4
lines changed

3 files changed

+49
-4
lines changed

‎src/backend/utils/adt/numeric.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5789,9 +5789,15 @@ mul_var(NumericVar *var1, NumericVar *var2, NumericVar *result,
57895789
* to avoid normalizing carries immediately.
57905790
*
57915791
* maxdig tracks the maximum possible value of any dig[] entry; when this
5792-
* threatens to exceed INT_MAX, we take the time to propagate carries. To
5793-
* avoid overflow in maxdig itself, it actually represents the max
5794-
* possible value divided by NBASE-1.
5792+
* threatens to exceed INT_MAX, we take the time to propagate carries.
5793+
* Furthermore, we need to ensure that overflow doesn't occur during the
5794+
* carry propagation passes either. The carry values could be as much as
5795+
* INT_MAX/NBASE, so really we must normalize when digits threaten to
5796+
* exceed INT_MAX - INT_MAX/NBASE.
5797+
*
5798+
* To avoid overflow in maxdig itself, it actually represents the max
5799+
* possible value divided by NBASE-1, ie, at the top of the loop it is
5800+
* known that no dig[] entry exceeds maxdig * (NBASE-1).
57955801
*/
57965802
dig= (int*)palloc0(res_ndigits*sizeof(int));
57975803
maxdig=0;
@@ -5806,7 +5812,7 @@ mul_var(NumericVar *var1, NumericVar *var2, NumericVar *result,
58065812

58075813
/* Time to normalize? */
58085814
maxdig+=var1digit;
5809-
if (maxdig>INT_MAX / (NBASE-1))
5815+
if (maxdig>(INT_MAX-INT_MAX /NBASE) / (NBASE-1))
58105816
{
58115817
/* Yes, do it */
58125818
carry=0;

‎src/test/regress/expected/numeric.out

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1333,6 +1333,33 @@ SELECT * FROM num_input_test;
13331333
NaN
13341334
(7 rows)
13351335

1336+
--
1337+
-- Test some corner cases for multiplication
1338+
--
1339+
select 4790999999999999999999999999999999999999999999999999999999999999999999999999999999999999 * 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
1340+
?column?
1341+
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1342+
47909999999999999999999999999999999999999999999999999999999999999999999999999999999999985209000000000000000000000000000000000000000000000000000000000000000000000000000000000001
1343+
(1 row)
1344+
1345+
select 4789999999999999999999999999999999999999999999999999999999999999999999999999999999999999 * 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
1346+
?column?
1347+
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1348+
47899999999999999999999999999999999999999999999999999999999999999999999999999999999999985210000000000000000000000000000000000000000000000000000000000000000000000000000000000001
1349+
(1 row)
1350+
1351+
select 4770999999999999999999999999999999999999999999999999999999999999999999999999999999999999 * 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
1352+
?column?
1353+
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1354+
47709999999999999999999999999999999999999999999999999999999999999999999999999999999999985229000000000000000000000000000000000000000000000000000000000000000000000000000000000001
1355+
(1 row)
1356+
1357+
select 4769999999999999999999999999999999999999999999999999999999999999999999999999999999999999 * 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
1358+
?column?
1359+
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1360+
47699999999999999999999999999999999999999999999999999999999999999999999999999999999999985230000000000000000000000000000000000000000000000000000000000000000000000000000000000001
1361+
(1 row)
1362+
13361363
--
13371364
-- Test some corner cases for division
13381365
--

‎src/test/regress/sql/numeric.sql

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -821,6 +821,18 @@ INSERT INTO num_input_test(n1) VALUES (' N aN ');
821821

822822
SELECT*FROM num_input_test;
823823

824+
--
825+
-- Test some corner cases for multiplication
826+
--
827+
828+
select4790999999999999999999999999999999999999999999999999999999999999999999999999999999999999*9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
829+
830+
select4789999999999999999999999999999999999999999999999999999999999999999999999999999999999999*9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
831+
832+
select4770999999999999999999999999999999999999999999999999999999999999999999999999999999999999*9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
833+
834+
select4769999999999999999999999999999999999999999999999999999999999999999999999999999999999999*9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;
835+
824836
--
825837
-- Test some corner cases for division
826838
--

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp