Re: BUG #19780: gtsvector_picksplit() reads uninitialized data when called with three entries

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: shihao zhong <zhong950419(at)gmail(dot)com>
Cc: exclusion(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19780: gtsvector_picksplit() reads uninitialized data when called with three entries
Date: 2026-11-06 07:52:21
Message-ID: au2HNfBBz9haENO4@paquier.xyz
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On Wed, Nov 04, 2026 at 12:42:55AM -0500, shihao zhong wrote:
> Thanks for the report. With only two entries, the cache of the second
> one is used before it is filled.
>
> Your two column case is harmless. With one column, the index can miss
> rows until REINDEX.
>
> The attached patch fills the cache earlier and adds a test.

So the problem is this one, where we could try to read the cached data
for seed_2 but it's just not initialized yet:
datum_r = gtsvector_alloc(SIGNKEY | (cache[seed_2].allistrue ?
ALLISTRUE : 0), siglen, cache[seed_2].sign);

Calling fillcache() earlier so as datum_r and datum_l are built from
correct values is enough. Your change makes sense.
--
Michael

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Michael Paquier 2026-11-06 08:16:37 Re: BUG #19780: gtsvector_picksplit() reads uninitialized data when called with three entries
Previous Message Amit Langote 2026-11-06 02:31:29 Re: BUG #19768: JSON_TABLE: row/text comparisons in context item or PASSING give wrong results or spurious collation