Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow - Mailing list pgsql-bugs

From Richard Guo
Subject Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow
Date
Msg-id CAMbWs48QRWz7y52kGTwdSDYcerb_9FdCczJG3-_=RAQz0cNMOw@mail.gmail.com
Whole thread Raw
In response to Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow  (Richard Guo <guofenglinux@gmail.com>)
Responses Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow
List pgsql-bugs
On Tue, Feb 17, 2026 at 10:55 AM Richard Guo <guofenglinux@gmail.com> wrote:
> I've included test cases covering the overflow scenarios for ROWS mode
> in v3.  (I failed to come up with queries for GROUPS mode that
> demonstrate the bug, but I suspect I just haven't found the right test
> case yet.)  I have also included a commit message.

Here is the updated patch.  I've added test cases for GROUPS mode with
an overflow-inducing offset.  These don't seem to produce visibly
wrong results without the patch.  I believe that is because the
incremental nature of group pointer advancement happens to mask the
misbehavior.  But I think they are still worth having since signed
integer overflow is undefined behavior in C.

Regarding performance, I don't think this should be a concern.
pg_add_s64_overflow compiles down to a native add+jo sequence on
platforms with __builtin_add_overflow, and falls back to a couple of
inlined comparisons on others.  Either way, the cost seems negligible
next to the per-row tuple store and aggregation work these functions
already do.

- Richard

Attachment

pgsql-bugs by date:

Previous
From: Michael Paquier
Date:
Subject: Re: BUG #19416: Backend SIGSEGV in ExecShutdownHashJoin/ExecHashTableDetach/dsa_free
Next
From: Tom Lane
Date:
Subject: Re: BUG #19452: heap-buffer-overflow in `pg_basebackup --format=tar --gzip`