From c70f6dc6bd793cca86c734865914a031ef88240f Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Wed, 4 Mar 2026 12:08:37 -0500 Subject: [PATCH] Fix yet another bug in archive streamer with LZ4 decompression. The code path in astreamer_lz4_decompressor_content() that updated the output pointers when the output buffer isn't full was wrong. It advanced next_out by bytes_written, which could include previous decompression output not just that of the current cycle. The correct amount to advance is out_size. While at it, make the output pointer updates look more like the input pointer updates. This bug is pretty hard to reach, as it requires consecutive compression frames that are too small to fill the output buffer. pg_dump could have produced such data before 66ec01dc4, but I'm unsure whether any files we use astreamer with would be likely to contain problematic data. Author: Chao Li Reviewed-by: Tom Lane Discussion: https://postgr.es/m/0594CC79-1544-45DD-8AA4-26270DE777A7@gmail.com Backpatch-through: 15 --- src/fe_utils/astreamer_lz4.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/src/fe_utils/astreamer_lz4.c b/src/fe_utils/astreamer_lz4.c index a5865c93598..e196fcc81e5 100644 --- a/src/fe_utils/astreamer_lz4.c +++ b/src/fe_utils/astreamer_lz4.c @@ -360,11 +360,14 @@ astreamer_lz4_decompressor_content(astreamer *streamer, avail_in -= read_size; next_in += read_size; + /* Update output buffer based on number of bytes produced */ + avail_out -= out_size; + next_out += out_size; mystreamer->bytes_written += out_size; /* * If output buffer is full then forward the content to next streamer - * and update the output buffer. + * and reset the output buffer. */ if (mystreamer->bytes_written >= mystreamer->base.bbs_buffer.maxlen) { @@ -374,13 +377,8 @@ astreamer_lz4_decompressor_content(astreamer *streamer, context); avail_out = mystreamer->base.bbs_buffer.maxlen; - mystreamer->bytes_written = 0; next_out = (uint8 *) mystreamer->base.bbs_buffer.data; - } - else - { - avail_out = mystreamer->base.bbs_buffer.maxlen - mystreamer->bytes_written; - next_out += mystreamer->bytes_written; + mystreamer->bytes_written = 0; } } }