diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2024-01-07 15:19:50 -0500 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2024-01-07 15:19:50 -0500 |
| commit | 9034a2d5123498104ef1e515c0b56d70d98d0ce2 (patch) | |
| tree | 4a3c13b366076a828b4d47b61365e58d0e55fcd0 /contrib/intarray/_int_gist.c | |
| parent | 2a67b5a60ee68892bb028587ddc6de7650822480 (diff) | |
| download | postgresql-9034a2d5123498104ef1e515c0b56d70d98d0ce2.tar.gz postgresql-9034a2d5123498104ef1e515c0b56d70d98d0ce2.zip | |
Fix integer-overflow problem in intarray's g_int_decompress().
An array element equal to INT_MAX gave this code indigestion,
causing an infinite loop that surely ended in SIGSEGV. We fixed
some nearby problems awhile ago (cf 757c5182f) but missed this.
Report and diagnosis by Alexander Lakhin (bug #18273); patch by me
Discussion: https://postgr.es/m/18273-9a832d1da122600c@postgresql.org
Diffstat (limited to 'contrib/intarray/_int_gist.c')
| -rw-r--r-- | contrib/intarray/_int_gist.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/contrib/intarray/_int_gist.c b/contrib/intarray/_int_gist.c index 98145fe3703..a09b7fa812c 100644 --- a/contrib/intarray/_int_gist.c +++ b/contrib/intarray/_int_gist.c @@ -297,8 +297,7 @@ g_int_decompress(PG_FUNCTION_ARGS) ArrayType *in; int lenin; int *din; - int i, - j; + int i; in = DatumGetArrayTypeP(entry->key); @@ -342,9 +341,12 @@ g_int_decompress(PG_FUNCTION_ARGS) dr = ARRPTR(r); for (i = 0; i < lenin; i += 2) - for (j = din[i]; j <= din[i + 1]; j++) + { + /* use int64 for j in case din[i + 1] is INT_MAX */ + for (int64 j = din[i]; j <= din[i + 1]; j++) if ((!i) || *(dr - 1) != j) - *dr++ = j; + *dr++ = (int) j; + } if (in != (ArrayType *) DatumGetPointer(entry->key)) pfree(in); |