Re: BUG #19545: Integer truncation of `GinTuple.keylen` causes out-of-bounds read in parallel GIN index build

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Peter Eisentraut <peter(at)eisentraut(dot)org>
Cc: Ewan Young <kdbase(dot)hack(at)gmail(dot)com>, Heikki Linnakangas <hlinnaka(at)iki(dot)fi>, 1217816127(at)qq(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19545: Integer truncation of `GinTuple.keylen` causes out-of-bounds read in parallel GIN index build
Date: 2026-09-18 02:07:26
Message-ID: 954960.1789697246@sss.pgh.pa.us
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Peter Eisentraut <peter(at)eisentraut(dot)org> writes:
> I have committed these, thanks.

The ABI-compliance-checking buildfarm animals have all been unhappy
since this went in:

'struct GinTuple' changed:
type size changed from 16 to 24 (in bytes)
1 data member deletion:
'uint16 keylen', at offset 6 (in bytes)
1 data member insertion:
'union {Size keylen; double force_align_d; int64 force_align_i64;} u', at offset 8 (in bytes)
there are data member changes:
'int16 typlen' offset changed from 8 to 16 (in bytes) (by +8 bytes)
'bool typbyval' offset changed from 10 to 18 (in bytes) (by +8 bytes)
'signed char category' offset changed from 11 to 19 (in bytes) (by +8 bytes)
'int nitems' offset changed from 12 to 20 (in bytes) (by +8 bytes)
'char data[]' offset changed from 16 to 24 (in bytes) (by +8 bytes)

Is it really okay to change this struct in v18?
If so, the .abi-compliance-history files need to be updated.

regards, tom lane

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message PG Bug reporting form 2026-09-18 02:39:08 BUG #19693: JSON_VALUE/JSON_QUERY PASSING a toasted text value reads the toast pointer instead of the text
Previous Message Tender Wang 2026-09-18 02:02:42 Re: wrong results: merge when not matched by source