]> git.ipfire.org Git - thirdparty/postgresql.git/commit
pg_surgery: Fix off-by-one bug with heap offset
authorMichael Paquier <michael@paquier.xyz>
Fri, 5 Jun 2026 23:16:43 +0000 (08:16 +0900)
committerMichael Paquier <michael@paquier.xyz>
Fri, 5 Jun 2026 23:16:43 +0000 (08:16 +0900)
commitdaf8bc7d41acf0e4439ee137a6e9ae064a05de79
treeef53d343f13892493f4e560386825abefe9fcbd0
parenta572dd213f79898ad6ca66ac9d8b0912040e6691
pg_surgery: Fix off-by-one bug with heap offset

heap_force_common() declared a boolean array indexed with an
OffsetNumber for a size of MaxHeapTuplesPerPage.  OffsetNumbers are
1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage
wrote one byte past the end of the stack array, crashing the server.

Like heapam_handler.c, this commit changes the array so as it uses a
0-based index, substracting one from the OffsetNumbers.

Reported-by: Wang Yuelin <violin0613@tju.edu.cn>
Reviewed-by: Ashutosh Sharma <ashu.coek88@gmail.com>
Discussion: https://postgr.es/m/20260604002256.40f1fd544@smtp.qiye.163.com
Backpatch-through: 14
contrib/pg_surgery/heap_surgery.c