From ae5f5a0516630ddfd12cc06fe8555e22ec1ac11a Mon Sep 17 00:00:00 2001 From: David Rowley Date: Wed, 21 Oct 2026 10:58:30 +1300 Subject: [PATCH v4 2/2] Detect overflows in various numerical aggregate transfns Here we add overflow checks to guard against overflowing the int8 sum of all inputs for sum(int2), sum(int4), avg(int2) and avg(int4). Such an overflow is very unlikely for the int2 versions, but somewhat possible to hit for the int4 versions when given billions of large enough inputs. Since our code and machines are getting faster, and with the advent of things like columnar table AMs, it's getting more likely that such an overflow could occur in a real use case. No guards have been added to the average count. That would require 2^63 input rows, which is not possible to achieve in a single instance of PostgreSQL, given other limitations such as 64-bit LSNs. Author: Andrei Lepikhov Discussion: https://postgr.es/m/1ddc2a6f-4b26-43d9-9f3b-5b5db98a486d@gmail.com --- src/backend/utils/adt/numeric.c | 38 ++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/src/backend/utils/adt/numeric.c b/src/backend/utils/adt/numeric.c index 338add18344..7deea2046f1 100644 --- a/src/backend/utils/adt/numeric.c +++ b/src/backend/utils/adt/numeric.c @@ -6372,7 +6372,11 @@ int2_sum(PG_FUNCTION_ARGS) oldsum = PG_GETARG_INT64(0); /* OK to do the addition. */ - newval = oldsum + (int64) PG_GETARG_INT16(1); + if (unlikely(pg_add_s64_overflow(oldsum, (int64) PG_GETARG_INT16(1), + &newval))) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("bigint out of range"))); PG_RETURN_INT64(newval); } @@ -6398,7 +6402,11 @@ int4_sum(PG_FUNCTION_ARGS) oldsum = PG_GETARG_INT64(0); /* OK to do the addition. */ - newval = oldsum + (int64) PG_GETARG_INT32(1); + if (unlikely(pg_add_s64_overflow(oldsum, (int64) PG_GETARG_INT32(1), + &newval))) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("bigint out of range"))); PG_RETURN_INT64(newval); } @@ -6454,6 +6462,7 @@ int2_avg_accum(PG_FUNCTION_ARGS) ArrayType *transarray; int16 newval = PG_GETARG_INT16(1); Int8TransTypeData *transdata; + int64 newsum; /* * If we're invoked as an aggregate, we can cheat and modify our first @@ -6470,8 +6479,14 @@ int2_avg_accum(PG_FUNCTION_ARGS) elog(ERROR, "expected 2-element int8 array"); transdata = (Int8TransTypeData *) ARR_DATA_PTR(transarray); + + if (unlikely(pg_add_s64_overflow(transdata->sum, (int64) newval, &newsum))) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("bigint out of range"))); + transdata->count++; - transdata->sum += newval; + transdata->sum = newsum; PG_RETURN_ARRAYTYPE_P(transarray); } @@ -6482,6 +6497,7 @@ int4_avg_accum(PG_FUNCTION_ARGS) ArrayType *transarray; int32 newval = PG_GETARG_INT32(1); Int8TransTypeData *transdata; + int64 newsum; /* * If we're invoked as an aggregate, we can cheat and modify our first @@ -6498,8 +6514,14 @@ int4_avg_accum(PG_FUNCTION_ARGS) elog(ERROR, "expected 2-element int8 array"); transdata = (Int8TransTypeData *) ARR_DATA_PTR(transarray); + + if (unlikely(pg_add_s64_overflow(transdata->sum, (int64) newval, &newsum))) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("bigint out of range"))); + transdata->count++; - transdata->sum += newval; + transdata->sum = newsum; PG_RETURN_ARRAYTYPE_P(transarray); } @@ -6511,6 +6533,7 @@ int4_avg_combine(PG_FUNCTION_ARGS) ArrayType *transarray2; Int8TransTypeData *state1; Int8TransTypeData *state2; + int64 newsum; if (!AggCheckCallContext(fcinfo, NULL)) elog(ERROR, "aggregate function called in non-aggregate context"); @@ -6529,8 +6552,13 @@ int4_avg_combine(PG_FUNCTION_ARGS) state1 = (Int8TransTypeData *) ARR_DATA_PTR(transarray1); state2 = (Int8TransTypeData *) ARR_DATA_PTR(transarray2); + if (unlikely(pg_add_s64_overflow(state1->sum, state2->sum, &newsum))) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("bigint out of range"))); + state1->count += state2->count; - state1->sum += state2->sum; + state1->sum = newsum; PG_RETURN_ARRAYTYPE_P(transarray1); } -- 2.53.0