Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit512f67c

Browse files
committed
Avoid integer overflow while sifting-up a heap in tuplesort.c.
If the number of tuples in the heap exceeds approximately INT_MAX/2,this loop's calculation "2*i+1" could overflow, resulting in a crash.Fix it by using unsigned int rather than int for the relevant localvariables; that shouldn't cost anything extra on any popular hardware.Per bug #14722 from Sergey Koposov.Original patch by Sergey Koposov, modified by me per a suggestionfrom Heikki Linnakangas to use unsigned int not int64.Back-patch to 9.4, where tuplesort.c grew the ability to sort as manyas INT_MAX tuples in-memory (commit263865a).Discussion:https://postgr.es/m/20170629161637.1478.93109@wrigleys.postgresql.org
1 parentca906f6 commit512f67c

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

‎src/backend/utils/sort/tuplesort.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3490,19 +3490,24 @@ tuplesort_heap_replace_top(Tuplesortstate *state, SortTuple *tuple,
34903490
boolcheckIndex)
34913491
{
34923492
SortTuple*memtuples=state->memtuples;
3493-
inti,
3493+
unsignedinti,
34943494
n;
34953495

34963496
Assert(!checkIndex||state->currentRun==RUN_FIRST);
34973497
Assert(state->memtupcount >=1);
34983498

34993499
CHECK_FOR_INTERRUPTS();
35003500

3501+
/*
3502+
* state->memtupcount is "int", but we use "unsigned int" for i, j, n.
3503+
* This prevents overflow in the "2 * i + 1" calculation, since at the top
3504+
* of the loop we must have i < n <= INT_MAX <= UINT_MAX/2.
3505+
*/
35013506
n=state->memtupcount;
35023507
i=0;/* i is where the "hole" is */
35033508
for (;;)
35043509
{
3505-
intj=2*i+1;
3510+
unsignedintj=2*i+1;
35063511

35073512
if (j >=n)
35083513
break;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp