Fix integer-overflow problem in intarray's g_int_decompress().
An array element equal to INT_MAX gave this code indigestion,
causing an infinite loop that surely ended in SIGSEGV. We fixed
some nearby problems awhile ago (cf 757c5182f
) but missed this.
Report and diagnosis by Alexander Lakhin (bug #18273); patch by me
Discussion: https://postgr.es/m/18273-9a832d1da122600c@postgresql.org
This commit is contained in:
parent
1a7c03e6fc
commit
940ab02b53
|
@ -296,8 +296,7 @@ g_int_decompress(PG_FUNCTION_ARGS)
|
||||||
ArrayType *in;
|
ArrayType *in;
|
||||||
int lenin;
|
int lenin;
|
||||||
int *din;
|
int *din;
|
||||||
int i,
|
int i;
|
||||||
j;
|
|
||||||
|
|
||||||
in = DatumGetArrayTypeP(entry->key);
|
in = DatumGetArrayTypeP(entry->key);
|
||||||
|
|
||||||
|
@ -341,9 +340,12 @@ g_int_decompress(PG_FUNCTION_ARGS)
|
||||||
dr = ARRPTR(r);
|
dr = ARRPTR(r);
|
||||||
|
|
||||||
for (i = 0; i < lenin; i += 2)
|
for (i = 0; i < lenin; i += 2)
|
||||||
for (j = din[i]; j <= din[i + 1]; j++)
|
{
|
||||||
|
/* use int64 for j in case din[i + 1] is INT_MAX */
|
||||||
|
for (int64 j = din[i]; j <= din[i + 1]; j++)
|
||||||
if ((!i) || *(dr - 1) != j)
|
if ((!i) || *(dr - 1) != j)
|
||||||
*dr++ = j;
|
*dr++ = (int) j;
|
||||||
|
}
|
||||||
|
|
||||||
if (in != (ArrayType *) DatumGetPointer(entry->key))
|
if (in != (ArrayType *) DatumGetPointer(entry->key))
|
||||||
pfree(in);
|
pfree(in);
|
||||||
|
|
|
@ -6998,3 +6998,4 @@
|
||||||
{173,208,229}
|
{173,208,229}
|
||||||
{6,22,142,267,299}
|
{6,22,142,267,299}
|
||||||
{22,122,173,245,293}
|
{22,122,173,245,293}
|
||||||
|
{1,2,101,102,201,202,2147483647}
|
||||||
|
|
|
@ -464,13 +464,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SET enable_seqscan = off; -- not all of these would use index by default
|
SET enable_seqscan = off; -- not all of these would use index by default
|
||||||
|
@ -538,13 +538,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
INSERT INTO test__int SELECT array(SELECT x FROM generate_series(1, 1001) x); -- should fail
|
INSERT INTO test__int SELECT array(SELECT x FROM generate_series(1, 1001) x); -- should fail
|
||||||
|
@ -620,13 +620,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
DROP INDEX text_idx;
|
DROP INDEX text_idx;
|
||||||
|
@ -700,13 +700,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
DROP INDEX text_idx;
|
DROP INDEX text_idx;
|
||||||
|
@ -774,13 +774,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
DROP INDEX text_idx;
|
DROP INDEX text_idx;
|
||||||
|
@ -848,13 +848,13 @@ SELECT count(*) from test__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
SELECT count(*) from test__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from test__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
DROP INDEX text_idx;
|
DROP INDEX text_idx;
|
||||||
|
@ -870,9 +870,10 @@ DROP INDEX text_idx;
|
||||||
-- core that would reach the same codepaths.
|
-- core that would reach the same codepaths.
|
||||||
CREATE TABLE more__int AS SELECT
|
CREATE TABLE more__int AS SELECT
|
||||||
-- Leave alone NULLs, empty arrays and the one row that we use to test
|
-- Leave alone NULLs, empty arrays and the one row that we use to test
|
||||||
-- equality
|
-- equality; also skip INT_MAX
|
||||||
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
|
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
|
||||||
(select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000) from (select unnest(a) u) x)
|
(select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000)
|
||||||
|
from unnest(a) u where u < 2000000000)
|
||||||
END AS a, a as b
|
END AS a, a as b
|
||||||
FROM test__int;
|
FROM test__int;
|
||||||
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
|
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
|
||||||
|
@ -939,13 +940,13 @@ SELECT count(*) from more__int WHERE a @@ '(20&23)|(50&68)';
|
||||||
SELECT count(*) from more__int WHERE a @@ '20 | !21';
|
SELECT count(*) from more__int WHERE a @@ '20 | !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6566
|
6567
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
SELECT count(*) from more__int WHERE a @@ '!20 & !21';
|
SELECT count(*) from more__int WHERE a @@ '!20 & !21';
|
||||||
count
|
count
|
||||||
-------
|
-------
|
||||||
6343
|
6344
|
||||||
(1 row)
|
(1 row)
|
||||||
|
|
||||||
RESET enable_seqscan;
|
RESET enable_seqscan;
|
||||||
|
|
|
@ -194,9 +194,10 @@ DROP INDEX text_idx;
|
||||||
-- core that would reach the same codepaths.
|
-- core that would reach the same codepaths.
|
||||||
CREATE TABLE more__int AS SELECT
|
CREATE TABLE more__int AS SELECT
|
||||||
-- Leave alone NULLs, empty arrays and the one row that we use to test
|
-- Leave alone NULLs, empty arrays and the one row that we use to test
|
||||||
-- equality
|
-- equality; also skip INT_MAX
|
||||||
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
|
CASE WHEN a IS NULL OR a = '{}' OR a = '{73,23,20}' THEN a ELSE
|
||||||
(select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000) from (select unnest(a) u) x)
|
(select array_agg(u) || array_agg(u + 1000) || array_agg(u + 2000)
|
||||||
|
from unnest(a) u where u < 2000000000)
|
||||||
END AS a, a as b
|
END AS a, a as b
|
||||||
FROM test__int;
|
FROM test__int;
|
||||||
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
|
CREATE INDEX ON more__int using gist (a gist__int_ops(numranges = 252));
|
||||||
|
|
Loading…
Reference in New Issue