| From: | Richard Guo <guofenglinux(at)gmail(dot)com> |
|---|---|
| To: | Konstantin Knizhnik <knizhnik(at)garret(dot)ru> |
| Cc: | PostgreSQL mailing lists <pgsql-bugs(at)lists(dot)postgresql(dot)org>, Peter Geoghegan <pg(at)bowt(dot)ie> |
| Subject: | Re: Bug in heap_get_root_tuples |
| Date: | 2026-07-16 00:29:25 |
| Message-ID: | CAMbWs48CeYG2U=VQd4v7Lnkee+cEbYMycY1NA9Lu=DnQ3tk2BQ@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On Wed, Jul 15, 2026 at 10:37 PM Konstantin Knizhnik <knizhnik(at)garret(dot)ru> wrote:
> Commit c7aeb775df895db240dcd6f47242f7e08899adfb contains the following
> change:
>
> - /* Sanity check */
> - if (nextoffnum < FirstOffsetNumber || nextoffnum
> > maxoff)
> + /* Sanity check (pure paranoia) */
> + if (offnum < FirstOffsetNumber)
> + break;
> +
> + /*
> + * An offset past the end of page's line pointer
> array is possible
> + * when the array was truncated
> + */
> + if (offnum > maxoff)
> break;
>
> lp = PageGetItemId(page, nextoffnum);
>
>
> So it checks `offnum` and uses `nextoffnum`.
Nice catch. Seems like a copy/pasted typo.
- Richard
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Hayato Kuroda (Fujitsu) | 2026-07-16 00:36:15 | RE: BUG #19547: libpqrcv_create_slot dereferences NULL on a malformed CREATE_REPLICATION_SLOT reply |
| Previous Message | surya poondla | 2026-07-15 22:16:35 | Re: BUG #19382: Server crash at __nss_database_lookup |