Commit28328ec

committed

Fix overflow danger in SampleHeapTupleVisible()

68d9662 made HeapScanDesc->rs_ntuples unsigned but neglected tochange how it was being used in SampleHeapTupleVisible().Return early if rs_ntuples is 0 to avoid overflowing and incorrectlyexecuting the loop code in SampleHeapTupleVisible().Reported-by: Ranier VilelaDiscussion:https://postgr.es/m/CAEudQAot_xQoZyPZjpj1aBUPrPykY5mOPHGyvfe%3Djz%2BWowdA3A%40mail.gmail.com

1 parent68d9662 commit28328ecCopy full SHA for 28328ec

File tree

-3

lines changed

-3

lines changed

Lines changed: 9 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -2577,6 +2577,12 @@ SampleHeapTupleVisible(TableScanDesc scan, Buffer buffer,`
`2577`	`2577`
`2578`	`2578`	`if (scan->rs_flags&SO_ALLOW_PAGEMODE)`
`2579`	`2579`	`{`
	`2580`	`+uint32start,`
	`2581`	`+end;`
	`2582`	`+`
	`2583`	`+if (hscan->rs_ntuples==0)`
	`2584`	`+return false;`
	`2585`	`+`
`2580`	`2586`	`/*`
`2581`	`2587`	`* In pageatatime mode, heap_prepare_pagescan() already did visibility`
`2582`	`2588`	`* checks, so just look at the info it left in rs_vistuples[].`
`@@ -2586,12 +2592,12 @@ SampleHeapTupleVisible(TableScanDesc scan, Buffer buffer,`
`2586`	`2592`	`* in increasing order, but it's not clear that there would be enough`
`2587`	`2593`	`* gain to justify the restriction.`
`2588`	`2594`	`*/`
`2589`		`-intstart=0,`
`2590`		`-end=hscan->rs_ntuples-1;`
	`2595`	`+start=0;`
	`2596`	`+end=hscan->rs_ntuples-1;`
`2591`	`2597`
`2592`	`2598`	`while (start <=end)`
`2593`	`2599`	`{`
`2594`		`-intmid= (start+end) /2;`
	`2600`	`+uint32mid= (start+end) /2;`
`2595`	`2601`	`OffsetNumbercuroffset=hscan->rs_vistuples[mid];`
`2596`	`2602`
`2597`	`2603`	`if (tupoffset==curoffset)`

Comments

(0)