From bdd8ed973da9ab48aba2292b01f71d2f9968b82c Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 17 Jan 2011 12:38:52 -0500 Subject: [PATCH] Fix miscalculation of itemsafter in array_set_slice(). If the slice to be assigned to was before the existing array lower bound (requiring at least one null element to spring into existence to fill the gap), the code miscalculated how many entries needed to be copied from the old array's null bitmap. This could result in trashing the array's data area (as seen in bug #5840 from Karsten Loesing), or worse. This has been broken since we first allowed the behavior of assigning to non-adjacent slices, in 8.2. Back-patch to all affected versions. --- src/backend/utils/adt/arrayfuncs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/arrayfuncs.c b/src/backend/utils/adt/arrayfuncs.c index 1be96517df..d5391e8b98 100644 --- a/src/backend/utils/adt/arrayfuncs.c +++ b/src/backend/utils/adt/arrayfuncs.c @@ -2500,6 +2500,7 @@ array_set_slice(ArrayType *array, { /* * here we must allow for possibility of slice larger than orig array + * and/or not adjacent to orig array subscripts */ int oldlb = ARR_LBOUND(array)[0]; int oldub = oldlb + ARR_DIMS(array)[0] - 1; @@ -2508,10 +2509,12 @@ array_set_slice(ArrayType *array, char *oldarraydata = ARR_DATA_PTR(array); bits8 *oldarraybitmap = ARR_NULLBITMAP(array); + /* count/size of old array entries that will go before the slice */ itemsbefore = Min(slicelb, oldub + 1) - oldlb; lenbefore = array_nelems_size(oldarraydata, 0, oldarraybitmap, itemsbefore, elmlen, elmbyval, elmalign); + /* count/size of old array entries that will be replaced by slice */ if (slicelb > sliceub) { nolditems = 0; @@ -2525,7 +2528,8 @@ array_set_slice(ArrayType *array, nolditems, elmlen, elmbyval, elmalign); } - itemsafter = oldub - sliceub; + /* count/size of old array entries that will go after the slice */ + itemsafter = oldub + 1 - Max(sliceub + 1, oldlb); lenafter = olddatasize - lenbefore - olditemsize; } -- 2.40.0