Fix wrong variable offset sanity check. Commit c7aeb775 rewrote the HOT-chain offset sanity checks in three places, but in heap_get_root_tuples it accidentally tested offnum -- the outer loop variable, which is already bounded by the loop condition -- instead of nextoffnum, the offset actually passed to PageGetItemId. The pre-c7aeb775 check tested nextoffnum.
With the check ineffective, a stale t_ctid could make PageGetItemId read past the end of the line pointer array (which is data corruption that we expect to be able to catch here). Author: Peter Geoghegan <[email protected]> Reported-by: Konstantin Knizhnik <[email protected]> Discussion: https://postgr.es/m/[email protected] Backpatch-through: 15 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/656711398a6952b8d3258a337a06f85ec8dfabf6 Modified Files -------------- src/backend/access/heap/pruneheap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
