mirror of
https://github.com/postgres/postgres.git
synced 2026-06-20 23:51:26 -04:00
Michael Paquier
193a4ded94
heap_force_common() declared a boolean array indexed with an OffsetNumber for a size of MaxHeapTuplesPerPage. OffsetNumbers are 1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the stack array, crashing the server. Like heapam_handler.c, this commit changes the array so as it uses a 0-based index, substracting one from the OffsetNumbers. Reported-by: Wang Yuelin <violin0613@tju.edu.cn> Reviewed-by: Ashutosh Sharma <ashu.coek88@gmail.com> Discussion: https://postgr.es/m/20260604002256.40f1fd544@smtp.qiye.163.com Backpatch-through: 14