mirror of
https://github.com/postgres/postgres.git
synced 2026-06-25 08:29:05 -04:00
1eda3eb075
heap_force_common() declared a boolean array indexed with an OffsetNumber for a size of MaxHeapTuplesPerPage. OffsetNumbers are 1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the stack array, crashing the server. Like heapam_handler.c, this commit changes the array so as it uses a 0-based index, substracting one from the OffsetNumbers. Reported-by: Wang Yuelin <violin0613@tju.edu.cn> Reviewed-by: Ashutosh Sharma <ashu.coek88@gmail.com> Discussion: https://postgr.es/m/20260604002256.40f1fd544@smtp.qiye.163.com Backpatch-through: 14 |
||
|---|---|---|
| .. | ||
| expected | ||
| sql | ||
| .gitignore | ||
| heap_surgery.c | ||
| Makefile | ||
| pg_surgery--1.0.sql | ||
| pg_surgery.control | ||