Avoid possible overflow with ltsGetFreeBlock() in logtape.c

michaelpq · pull[bot] · commit f15f83d08196 · 2024-04-09T05:02:06.000Z
nFreeBlocks, defined as a long, stores the number of free blocks in a logical tape. ltsGetFreeBlock() has been using an int to store the value of nFreeBlocks, which could lead to overflows on platforms where long and int are not the same size (in short everything except Windows where long is 4 bytes). The problematic intermediate variable is switched to be a long instead of an int. Issue introduced by c02fdc9, so backpatch down to 13. Author: Ranier vilela Reviewed-by: Peter Geoghegan, David Rowley Discussion: https://postgr.es/m/CAEudQApLDWCBR_xmwNjGBrDo+f+S4E87x3s7-+hoaKqYdtC4JQ@mail.gmail.com Backpatch-through: 13
diff --git a/src/backend/utils/sort/logtape.c b/src/backend/utils/sort/logtape.c
@@ -372,7 +372,7 @@ ltsGetFreeBlock(LogicalTapeSet *lts)
 {
 	long	   *heap = lts->freeBlocks;
 	long		blocknum;
-	int			heapsize;
+	long		heapsize;
 	long		holeval;
 	unsigned long holepos;
 

Original file line number	Diff line number	Diff line change
`@@ -372,7 +372,7 @@ ltsGetFreeBlock(LogicalTapeSet *lts)`
`372`	`372`	`{`
`373`	`373`	`long *heap = lts->freeBlocks;`
`374`	`374`	`long blocknum;`
`375`		`- int heapsize;`
	`375`	`+ long heapsize;`
`376`	`376`	`long holeval;`
`377`	`377`	`unsigned long holepos;`
`378`	`378`