Bug in heap_get_root_tuples

Started by Konstantin Knizhnikabout 20 hours ago3 messagesbugs
Jump to latest
#1Konstantin Knizhnik
k.knizhnik@postgrespro.ru

Commit c7aeb775df895db240dcd6f47242f7e08899adfb contains the following
change:

-                       /* Sanity check */
-                       if (nextoffnum < FirstOffsetNumber || nextoffnum

maxoff)

+                       /* Sanity check (pure paranoia) */
+                       if (offnum < FirstOffsetNumber)
+                               break;
+
+                       /*
+                        * An offset past the end of page's line pointer 
array is possible
+                        * when the array was truncated
+                        */
+                       if (offnum > maxoff)
                                 break;

                        lp = PageGetItemId(page, nextoffnum);

So it checks `offnum` and uses `nextoffnum`.

#2Richard Guo
guofenglinux@gmail.com
In reply to: Konstantin Knizhnik (#1)
Re: Bug in heap_get_root_tuples

On Wed, Jul 15, 2026 at 10:37 PM Konstantin Knizhnik <knizhnik@garret.ru> wrote:

Commit c7aeb775df895db240dcd6f47242f7e08899adfb contains the following
change:

- /* Sanity check */
- if (nextoffnum < FirstOffsetNumber || nextoffnum

maxoff)

+                       /* Sanity check (pure paranoia) */
+                       if (offnum < FirstOffsetNumber)
+                               break;
+
+                       /*
+                        * An offset past the end of page's line pointer
array is possible
+                        * when the array was truncated
+                        */
+                       if (offnum > maxoff)
break;

lp = PageGetItemId(page, nextoffnum);

So it checks `offnum` and uses `nextoffnum`.

Nice catch. Seems like a copy/pasted typo.

- Richard

In reply to: Richard Guo (#2)
Re: Bug in heap_get_root_tuples

On Wed, Jul 15, 2026 at 8:29 PM Richard Guo <guofenglinux@gmail.com> wrote:

On Wed, Jul 15, 2026 at 10:37 PM Konstantin Knizhnik <knizhnik@garret.ru> wrote:

So it checks `offnum` and uses `nextoffnum`.

Nice catch. Seems like a copy/pasted typo.

Yeah, this is a bug. Will push a fix soon.

--
Peter Geoghegan