Re: [PATCH] pageinspect: validate line pointers before using them

At 2026-10-21 08:35:16, "shihao zhong" <zhong950419(at)gmail(dot)com> wrote:
>Hi Greg,
>
>Thanks for testing this. I reproduced your TRAP on a cassert build with
>both patches applied.
>
>v3 folds your change into 0001, with a Co-authored-by line for you.
>
>I also added a btree regression test that sets LP_DEAD on the high key of
>a multi-page index. It crashes without 0003 and gives the new error with it.

Hi,
Thanks for your work.
I have tested your patches.
With the v3 patch set,
issues can still be triggered with brin_page_items(set_byte()......) using a comparable method.

CREATE TABLE b2(a int);
INSERT INTO b2 SELECT g FROM generate_series(1,1000) g;
CREATE INDEX b2_brin ON b2 USING brin(a) WITH (pages_per_range = 1);

SELECT brin_page_items(
set_byte(set_byte(set_byte(set_byte(set_byte(
set_byte(set_byte(set_byte(set_byte(
get_raw_page('b2_brin', 2),
24, 248), 25, 159), 26, 10), 27, 0),
8184, 0), 8185, 0), 8186, 0), 8187, 0),
8188, 31),
'b2_brin'::regclass);

Observed result:
(1,0,1,f,f,f,f,"{24576 .. 0}")

This out-of-bounds data access triggers OOB reports under valgrind/ASan.
A SIGSEGV can likely be constructed using a similar approach.
Please take this into consideration.

Best regards,
Yilin Zhang