Re: [BUG] hstore integer overflow when constructing large values

Michael Paquier <michael(at)paquier(dot)xyz> 于2026年8月17日周一 10:42写道：

> While looking at that, I am reaching similar conclusions in terms of
> CALCDATASIZE(), and your version feels weird by having both a static
> inline function *and* a macro.. Your previous hstoreAddPairLen() is
> also tempting to keep. We apply the same rule in three places based
> on if a pair is null or not.

Agree

> Attached is presumably what I would do, which has some similarities
> with your v2, but it's a bit more expanded.

Thanks for the patch. I went through v3, and I think it is better and more
complete than my v2.

There is just one thing I noticed in `hstore_subscript_assign()`:

```
vsize = hstoreCalcDataSize(s1count + 1,
VARSIZE(hs) + p.keylen + p.vallen);
```

Here `VARSIZE(hs) + p.keylen + p.vallen` is still calculated using
unchecked additions before being passed to `hstoreCalcDataSize()`.

Given that the rest of the patch is moving allocation-size arithmetic to
`Size` and `add_size()`/`mul_size()`, I wonder if this should use
`add_size()` as well.

Perhaps the existing size limits make an overflow there unreachable in
practice, but using `add_size()` would seem more consistent with the rest
of this patch.

Other than that, v3 looks good to me.

--
Thanks,
Tender Wang