Re: postgres bug?

You are correct. I have modified the current sources. Good eye.

Hi Bruce,
I've been looking over the code in .../backend/utils/adt/selfuncs.c
and there are a number of functions in there like btreesel() that have
code
like this

float64
btreesel(...)
{
float64 result;
float64data resultData;

...
...

resultData = 1.0/3.0;
result = &resultData;

...
...

return result;
}

I don't pretend to understand all the contextual details about how the
function is used, but It seems that the return result is a pointer to an
invalid stack location. The storage is allocated as auto storage during
the function call, and with dynamic range restricted to the execution
of the function body.

The same thing is used in hashsel() as well, though not in btreenpage()
which
uses palloc() to allocate heap storage for the result.

Sorry for the informal form of the notice, but the machine that I work
on is a long way from the internet, and that makes compiling and mailing
a patch a pain.

Bernie

-- 
  Bruce Momjian                        |  http://www.op.net/~candle
  maillist@candle.pha.pa.us            |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026