| From: | Richard Guo <guofenglinux(at)gmail(dot)com> |
|---|---|
| To: | Tender Wang <tndrwang(at)gmail(dot)com> |
| Cc: | exclusion(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow |
| Date: | 2026-04-08 09:42:12 |
| Message-ID: | CAMbWs48QRWz7y52kGTwdSDYcerb_9FdCczJG3-_=RAQz0cNMOw@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On Tue, Feb 17, 2026 at 10:55 AM Richard Guo <guofenglinux(at)gmail(dot)com> wrote:
> I've included test cases covering the overflow scenarios for ROWS mode
> in v3. (I failed to come up with queries for GROUPS mode that
> demonstrate the bug, but I suspect I just haven't found the right test
> case yet.) I have also included a commit message.
Here is the updated patch. I've added test cases for GROUPS mode with
an overflow-inducing offset. These don't seem to produce visibly
wrong results without the patch. I believe that is because the
incremental nature of group pointer advancement happens to mask the
misbehavior. But I think they are still worth having since signed
integer overflow is undefined behavior in C.
Regarding performance, I don't think this should be a concern.
pg_add_s64_overflow compiles down to a native add+jo sequence on
platforms with __builtin_add_overflow, and falls back to a couple of
inlined comparisons on others. Either way, the cost seems negligible
next to the per-row tuple store and aggregation work these functions
already do.
- Richard
| Attachment | Content-Type | Size |
|---|---|---|
| v4-0001-Fix-integer-overflow-in-nodeWindowAgg.c.patch | application/octet-stream | 10.6 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2026-04-08 18:59:43 | Re: BUG #19452: heap-buffer-overflow in `pg_basebackup --format=tar --gzip` |
| Previous Message | Michael Paquier | 2026-04-08 02:06:14 | Re: BUG #19416: Backend SIGSEGV in ExecShutdownHashJoin/ExecHashTableDetach/dsa_free |