Re: BUG #18247: Integer overflow leads to negative width - Mailing list pgsql-bugs

From Richard Guo
Subject Re: BUG #18247: Integer overflow leads to negative width
Date
Msg-id CAMbWs4_WwOfr+fOP=1Uka9dgBWXWiO1zjYTrxaW=k=rMfQLB_w@mail.gmail.com
Whole thread Raw
In response to Re: BUG #18247: Integer overflow leads to negative width  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-bugs

On Fri, Dec 15, 2023 at 11:30 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
Richard Guo <guofenglinux@gmail.com> writes:
> On Fri, Dec 15, 2023 at 2:00 PM Alexander Lakhin <exclusion@gmail.com>
>> Your patch looks good to me, but maybe you would find it suitable to fix in
>> passing one more integer overflow in costsize.c?

> Nice catch.  The overflow occurs when cost_bitmap_heap_scan() calls
> compute_bitmap_pages(), and the loop_count parameter is converted from
> double to int.  I wonder if we can change the loop_count parameter to be
> double for compute_bitmap_pages() to avoid such overflow.

However, I'd be a bit uncomfortable about back-patching; since that
function is globally exposed, it's at least possible that some
extension is calling it and would see an ABI break.  Is it good enough
to fix this in HEAD?  I'd argue yes, given that a loop_count larger
than INT_MAX seems like a pretty improbable case.

I agree with you that it's good enough to fix this in HEAD.  The lack of
complaints from fields for so many years suggests that it's not a common
case to have loop_count larger than INT_MAX.

Thanks
Richard

pgsql-bugs by date:

Previous
From: Julien Rouhaud
Date:
Subject: Re: BUG #18251: Incorrect DROP VIEW pg_catalog.* behavior
Next
From: Richard Guo
Date:
Subject: Re: BUG #18247: Integer overflow leads to negative width