pgsql: pg_surgery: Fix infinite loop on large TID arrays

From: Álvaro Herrera <alvherre(at)kurilemu(dot)de>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: pg_surgery: Fix infinite loop on large TID arrays
Date: 2026-08-04 09:47:37
Message-ID: E1wrBkH-000000009Ci-32lx@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

pg_surgery: Fix infinite loop on large TID arrays

heap_force_common() tracked the current position in the caller-supplied
tid[] using OffsetNumber, which is only 16 bits wide, so when the array
held more than 65535 entries, the updated index wrapped around and the
outer loop never reached the exit condition. A SQL call with a
sufficiently large TID array would then run until interrupted.

Fix by tracking the tid[] position using int instead of OffsetNumber.
A regress case based on the report is included.

Author: Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com>
Reviewed-by: Andrey Borodin <x4mmm(at)yandex-team(dot)ru>
Reported-by: Yuelin Wang <1217816127(at)qq(dot)com>
Backpatch-through: 14
Bug: #19607
Discussion: https://postgr.es/m/19607-2f256a66481c514b@postgresql.org

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/346fbdcc2a92e86c7e964d637f8333c7b8197143

Modified Files
--------------
contrib/pg_surgery/expected/heap_surgery.out | 17 +++++++++++++++++
contrib/pg_surgery/heap_surgery.c | 6 +++---
contrib/pg_surgery/sql/heap_surgery.sql | 8 ++++++++
3 files changed, 28 insertions(+), 3 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Daniel Gustafsson 2026-08-04 10:21:03 pgsql: Do not reuse rd_smgr in fork loop when enabling data checksums
Previous Message Peter Eisentraut 2026-08-04 08:37:45 pgsql: doc: Add PROPERTY GRAPH to the access privilege tables