From 8af1f527842170a257ae0684dd02907135d8d2e5 Mon Sep 17 00:00:00 2001 From: Peter Geoghegan Date: Thu, 16 Jul 2026 18:55:33 -0400 Subject: [PATCH] Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum. With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan Reported-by: Konstantin Knizhnik Discussion: https://postgr.es/m/87c7d8a4-3a82-4334-bee6-e8c2ad3f3293@garret.ru Backpatch-through: 15 --- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/backend/access/heap/pruneheap.c b/src/backend/access/heap/pruneheap.c index a8025889be0..a36c6b842e8 100644 --- a/src/backend/access/heap/pruneheap.c +++ b/src/backend/access/heap/pruneheap.c @@ -1848,14 +1848,14 @@ heap_get_root_tuples(Page page, OffsetNumber *root_offsets) for (;;) { /* Sanity check (pure paranoia) */ - if (offnum < FirstOffsetNumber) + if (nextoffnum < FirstOffsetNumber) break; /* * An offset past the end of page's line pointer array is possible * when the array was truncated */ - if (offnum > maxoff) + if (nextoffnum > maxoff) break; lp = PageGetItemId(page, nextoffnum); -- 2.47.3