Negative value of numGroups

From: Andrey Lepikhov <a(dot)lepikhov(at)postgrespro(dot)ru>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Negative value of numGroups
Date: 2022-05-13 06:56:43
Message-ID: ebbc2efb-7ef9-bf2f-1ada-d6ec48f70e58@postgrespro.ru
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hi,

Using sqlancer I've found curious vulnerability. In some places of the
code we convert LONG_MAX to double. After value of 2^53 double doesn't
correspond to a long value precisely. So, LONG_MAX can be converted into
'LONG_MAX + 1' double value. And string:

(long) Min(numGroups, (double) LONG_MAX);

can return negative value, if numGroups > LONG_MAX.
Maybe it isn't practical issue right now, but this annoying thing
doesn't allow to pass sqlancer tests sometimes, for example, with options:

--extensions='pg_stat_statements' --oracle HAVING

It is not difficult to fix the problem in-place, of course. But maybe do
better: change the type of numGroups field in any Plan nodes to double
and convert it into specific type right before usage?

--
Regards
Andrey Lepikhov
Postgres Professional

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Laetitia Avrot 2022-05-14 15:11:33 Re: Statistics updates is delayed when using `commit and chain`
Previous Message Tom Lane 2022-05-12 14:51:22 Re: BUG #17479: "plan should not reference subplan's variable" when calling `grouping` on result of subquery