pgsql: Fix wrong variable offset sanity check.

Fix wrong variable offset sanity check.

Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three
places, but in heap_get_root_tuples it accidentally tested offnum -- the
outer loop variable, which is already bounded by the loop condition --
instead of nextoffnum, the offset actually passed to PageGetItemId. The
pre-c7aeb775 check tested nextoffnum.

With the check ineffective, a stale t_ctid could make PageGetItemId read
past the end of the line pointer array (which is data corruption that we
expect to be able to catch here).

Author: Peter Geoghegan <pg(at)bowt(dot)ie>
Reported-by: Konstantin Knizhnik <knizhnik(at)garret(dot)ru>
Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru
Backpatch-through: 15

Branch
------
REL_15_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/aaad61f5f2700252bf9d51ae79ebbb2fdec8c0ac

Modified Files
--------------
src/backend/access/heap/pruneheap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)