Bug in heap_get_root_tuples
Commit c7aeb775df895db240dcd6f47242f7e08899adfb contains the following
change:
- /* Sanity check */
- if (nextoffnum < FirstOffsetNumber || nextoffnum
maxoff)
+ /* Sanity check (pure paranoia) */
+ if (offnum < FirstOffsetNumber)
+ break;
+
+ /*
+ * An offset past the end of page's line pointer
array is possible
+ * when the array was truncated
+ */
+ if (offnum > maxoff)
break;
lp = PageGetItemId(page, nextoffnum);
So it checks `offnum` and uses `nextoffnum`.
On Wed, Jul 15, 2026 at 10:37 PM Konstantin Knizhnik <knizhnik@garret.ru> wrote:
Commit c7aeb775df895db240dcd6f47242f7e08899adfb contains the following
change:- /* Sanity check */
- if (nextoffnum < FirstOffsetNumber || nextoffnummaxoff)
+ /* Sanity check (pure paranoia) */ + if (offnum < FirstOffsetNumber) + break; + + /* + * An offset past the end of page's line pointer array is possible + * when the array was truncated + */ + if (offnum > maxoff) break;lp = PageGetItemId(page, nextoffnum);
So it checks `offnum` and uses `nextoffnum`.
Nice catch. Seems like a copy/pasted typo.
- Richard
On Wed, Jul 15, 2026 at 8:29 PM Richard Guo <guofenglinux@gmail.com> wrote:
On Wed, Jul 15, 2026 at 10:37 PM Konstantin Knizhnik <knizhnik@garret.ru> wrote:
So it checks `offnum` and uses `nextoffnum`.
Nice catch. Seems like a copy/pasted typo.
Yeah, this is a bug. Will push a fix soon.
--
Peter Geoghegan