Re: Fix uninitialized PruneFreezeResult in pruneheap and vacuumlazy

Thu, 11 Dec 2025 02:18:19 -0800 

Hi Chao Li,Hackers,


&gt; PruneFreezeResult presult; <== here presult is not initialized


&gt; &nbsp; const PruneFreezeResult *presult, <== presult is a const pointer, 
so prune_freeze_setup won’t update its content
&gt; &nbsp; PruneState *prstate)
&gt; {
&gt; &nbsp; &nbsp; prstate-&gt;deadoffsets = (OffsetNumber *) 
presult-&gt;deadoffsets; <== presult-&gt;deadoffsets could be a random value
&gt; }
&gt; ```


&gt; Attached is a simple fix by just initializing presult in the first place 
with {0}.&nbsp;


&nbsp; &nbsp; Initializing ’presult‘ under my operating system is very 
effective.
&nbsp; &nbsp; I have tested the change, and "make check" passed.




Best regards！


Feilong&nbsp;Meng
[email protected]

HighGo&nbsp;Software&nbsp;Co.,&nbsp;Ltd.


https://www.highgo.com/


        



         Original
         
       
From: Chao Li <[email protected]&gt;
Date: 2025-12-11 12:02
To: Postgres hackers <[email protected]&gt;
Cc: Melanie Plageman <[email protected]&gt;
Subject: Fix uninitialized PruneFreezeResult in pruneheap and vacuumlazy



Hi Hackers,

While reviewing Melanie's patch [1], I found this bug where presult is not 
initialized. Let me explain the logic.

In the first place:
```
static int
lazy_scan_prune(LVRelState *vacrel,
Buffer buf,
BlockNumber blkno,
Page page,
Buffer vmbuffer,
bool all_visible_according_to_vm,
bool *has_lpdead_items,
bool *vm_page_frozen)
{
Relation        rel = vacrel-&gt;rel;
PruneFreezeResult presult; <== here presult is not initialized


heap_page_prune_and_freeze(&amp;params,
&nbsp; &amp;presult, <== uninitialized presult is passed 
into&nbsp;heap_page_prune_and_freeze
&nbsp; &amp;vacrel-&gt;offnum,
&nbsp; &amp;vacrel-&gt;NewRelfrozenXid, &amp;vacrel-&gt;NewRelminMxid);
```


Then in&nbsp;heap_page_prune_and_freeze():
```
void
heap_page_prune_and_freeze(PruneFreezeParams *params,
&nbsp; PruneFreezeResult *presult,
&nbsp; OffsetNumber *off_loc,
&nbsp; TransactionId *new_relfrozen_xid,
&nbsp; MultiXactId *new_relmin_mxid)
{
Buffer          buffer = params-&gt;buffer;
Page            page = BufferGetPage(buffer);
PruneState      prstate;
bool            do_freeze;
bool            do_prune;
bool            do_hint_prune;
bool            did_tuple_hint_fpi;
int64           fpi_before = pgWalUsage.wal_fpi;


/* Initialize prstate */
prune_freeze_setup(params,
&nbsp; new_relfrozen_xid, new_relmin_mxid,
&nbsp; presult, &amp;prstate); <== immediately pass&nbsp;uninitialized presult 
to&nbsp;prune_freeze_setup
```


Then in&nbsp;prune_freeze_setup():
```
static void
prune_freeze_setup(PruneFreezeParams *params,
&nbsp; TransactionId *new_relfrozen_xid,
&nbsp; MultiXactId *new_relmin_mxid,
&nbsp; const PruneFreezeResult *presult, <== presult is a const pointer, 
so&nbsp;prune_freeze_setup won’t update its content
&nbsp; PruneState *prstate)
{
&nbsp; &nbsp; prstate-&gt;deadoffsets = (OffsetNumber *) 
presult-&gt;deadoffsets; <==&nbsp;presult-&gt;deadoffsets could be a random 
value
}
```


Attached is a simple fix by just initializing presult in the first place with 
{0}.&nbsp;


[1] 
https://postgr.es/m/CAAKRu_bvQiesumRhgvbcym1T9Z9=ddgfubi-dsnxlrc6jvl...@mail.gmail.com


Best regards,
 --
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/

Reply via email to