From 7f31ab39795afa496899cef62d16852d12e2ec31 Mon Sep 17 00:00:00 2001 From: Richard Guo Date: Sat, 14 Feb 2026 18:16:27 +0900 Subject: [PATCH v1] Fix signed integer overflow in nodeWindowAgg.c --- src/backend/executor/nodeWindowAgg.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/backend/executor/nodeWindowAgg.c b/src/backend/executor/nodeWindowAgg.c index d9b64b0f465..06519d4df70 100644 --- a/src/backend/executor/nodeWindowAgg.c +++ b/src/backend/executor/nodeWindowAgg.c @@ -37,6 +37,7 @@ #include "catalog/objectaccess.h" #include "catalog/pg_aggregate.h" #include "catalog/pg_proc.h" +#include "common/int.h" #include "executor/executor.h" #include "executor/nodeWindowAgg.h" #include "miscadmin.h" @@ -1532,12 +1533,17 @@ row_is_in_frame(WindowObject winobj, int64 pos, TupleTableSlot *slot, if (frameOptions & FRAMEOPTION_ROWS) { int64 offset = DatumGetInt64(winstate->endOffsetValue); + int64 target_pos; /* rows after current row + offset are out of frame */ if (frameOptions & FRAMEOPTION_END_OFFSET_PRECEDING) offset = -offset; - if (pos > winstate->currentpos + offset) + if (pg_add_s64_overflow(winstate->currentpos, offset, &target_pos)) + { + /* overflow: frame extends to end of partition */ + } + else if (pos > target_pos) return -1; } else if (frameOptions & (FRAMEOPTION_RANGE | FRAMEOPTION_GROUPS)) -- 2.39.5 (Apple Git-154)