| From: | Andrey Lepikhov <a(dot)lepikhov(at)postgrespro(dot)ru> |
|---|---|
| To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Negative value of numGroups |
| Date: | 2022-05-13 06:56:43 |
| Message-ID: | ebbc2efb-7ef9-bf2f-1ada-d6ec48f70e58@postgrespro.ru |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
Hi,
Using sqlancer I've found curious vulnerability. In some places of the
code we convert LONG_MAX to double. After value of 2^53 double doesn't
correspond to a long value precisely. So, LONG_MAX can be converted into
'LONG_MAX + 1' double value. And string:
(long) Min(numGroups, (double) LONG_MAX);
can return negative value, if numGroups > LONG_MAX.
Maybe it isn't practical issue right now, but this annoying thing
doesn't allow to pass sqlancer tests sometimes, for example, with options:
--extensions='pg_stat_statements' --oracle HAVING
It is not difficult to fix the problem in-place, of course. But maybe do
better: change the type of numGroups field in any Plan nodes to double
and convert it into specific type right before usage?
--
Regards
Andrey Lepikhov
Postgres Professional
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Laetitia Avrot | 2022-05-14 15:11:33 | Re: Statistics updates is delayed when using `commit and chain` |
| Previous Message | Tom Lane | 2022-05-12 14:51:22 | Re: BUG #17479: "plan should not reference subplan's variable" when calling `grouping` on result of subquery |