Re: Possible integer overflow in bringetbitmap()

On Tue, Nov 26, 2024 at 2:57 AM Evgeniy Gorbanyov
<gorbanyoves(at)basealt(dot)ru> wrote:
>
> Function bringetbitmap() in src/backend/access/brin/brin.c:560 returns type int64. But the returned variable 'totalpages' is of type int. Maybe it makes sense to change the type of variable 'totalpages' to int64 to avoid possible overflow in expression 'totalpages * 10'?

It looks to me like "totalpages" can never be larger than "nblocks",
which is of type BlockNumber, an alias for uint32.

The reason the function returns int64 is because it multiplies
"totalpages" by 10. However, notice that the existing line:

return totalpages * 10;

-- doesn't cast either "totalpages" or "10" to "int64", so the result
is of type uint32 again, which leads to integer overflow.

So, I think your patch should be, instead, to cast either "totalpages"
or "10" to "int64", in the return statement.