Thread: Fix overflow in pg_size_pretty

On Sun, 28 Jul 2024 at 07:18, Joseph Koshakow <koshy44@gmail.com> wrote:
> Attached is a patch that resolves an overflow in pg_size_pretty() that
> resulted in unexpected behavior when PG_INT64_MIN was passed in as an
> argument.

Could we just fix this more simply by assigning the absolute value of
the signed variable into an unsigned type?  It's a bit less code and
gets rid of the explicit test for PG_INT64_MIN.

David

On Sun, 28 Jul 2024 at 11:06, Joseph Koshakow <koshy44@gmail.com> wrote:
> > + uint64 usize = size < 0 ? (uint64) (-size) : (uint64) size;
>
> I think that the explicit test for PG_INT64_MIN is still required. If
> `size` is equal to PG_INT64_MIN then `-size` will overflow. You end up
> with the correct behavior if `size` wraps around, but that's only
> guaranteed on platforms that support the `-fwrapv` flag.

What if we spelt it out the same way as pg_lltoa() does?

i.e: uint64 usize = size < 0 ? 0 - (uint64) size : (uint64) size;

David

On Sun, 28 Jul 2024 at 13:10, Joseph Koshakow <koshy44@gmail.com> wrote:
>
> On Sat, Jul 27, 2024 at 8:00 PM David Rowley <dgrowleyml@gmail.com> wrote:
> > What if we spelt it out the same way as pg_lltoa() does?
> >
> > i.e: uint64 usize = size < 0 ? 0 - (uint64) size : (uint64) size;
>
> My understanding of pg_lltoa() is that it produces an underflow and
> relies wrapping around from 0 to PG_UINT64_MAX. In fact the following
> SQL, which relies on pg_lltoa() under the hood, panics with `-ftrapv`
> enabled (which panics on underflows and overflows):
>
>     SELECT int8out(-9223372036854775808);

I didn't test to see where that's coming from, but I did test the two
attached .c files.  int.c uses the 0 - (unsigned int) var method and
int2.c uses (unsigned int) (-var).  Using clang and -ftrapv, I get:

$ clang int.c -o int -O2 -ftrapv
$ ./int
2147483648
$ clang int2.c -o int2 -O2 -ftrapv
$ ./int2
Illegal instruction

Similar with gcc:
$ gcc int.c -o int -O2 -ftrapv
$ ./int
2147483648
$ gcc int2.c -o int2 -O2 -ftrapv
$ ./int2
Aborted

I suspect your trap must be coming from somewhere else. It looks to me
like the "uint64 usize = size < 0 ? 0 - (uint64) size : (uint64)
size;" will be fine.

David

On Sun, 28 Jul 2024 at 16:30, Joseph Koshakow <koshy44@gmail.com> wrote:
> Attached is an updated patch with your approach. I removed the 0 from
> the negative case because I think it was unnecessary, but happy to add
> it back in if I missed something.

I made a few adjustments and pushed this.  I did keep the 0 - part as
some compilers don't seem to like not having the 0.  e.g MSVC gives:

../src/backend/utils/adt/dbsize.c(578): warning C4146: unary minus
operator applied to unsigned type, result still unsigned

I thought a bit about if it was really worth keeping the regression
test or not and in the end decided it was likely worthwhile keeping
it, so I expanded it slightly to cover both PG_INT64_MIN and
PG_INT64_MAX values. It looks slightly less like we're earmarking the
fact that there was a bug that way, and also seems to be of some
additional value.

PG15 did see quite a significant rewrite of the pg_size_pretty code.
The bug does still exist in PG14 and earlier, but on looking at what
it would take to fix it there I got a bit unexcited at the risk to
reward ratio of adjusting that code and just left it alone. I've
backpatched only as far as PG15. I'm sure someone else will feel I
should have done something else there, but that's the judgement call I
made.

Thanks for the patch.

David