PG Bug reporting form <noreply(at)postgresql(dot)org> writes:
> As far as I can see, the loop for j shown below:
> Datum
> g_int_decompress(PG_FUNCTION_ARGS)
> {
> ...
> for (i = 0; i < lenin; i += 2)
> for (j = din[i]; j <= din[i + 1]; j++)
> if ((!i) || *(dr - 1) != j)
> *dr++ = j;
> overflows when dln[i] == dln[i+1] == 2147483647.
Yeah, you are right. Probably the simplest fix is to widen j to
int64. I see that somebody has already int64-ified g_int_compress
and internal_size (else we'd not get this far), but they missed this.
Will fix, thanks for report!
regards, tom lane