Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum.
With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <[email protected]> Reported-by: Konstantin Knizhnik <[email protected]> Discussion: https://postgr.es/m/[email protected] Backpatch-through: 15 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8af1f527842170a257ae0684dd02907135d8d2e5 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
