Re: [PATCH] pageinspect: validate line pointers before using them

[Yilin Zhang]

At 2026-10-21 08:35:16, "shihao zhong" <zhong950...@gmail.com> wrote:
>Hi Greg,
>
>Thanks for testing this. I reproduced your TRAP on a cassert build with
>both patches applied.
>
>v3 folds your change into 0001, with a Co-authored-by line for you.
>
>I also added a btree regression test that sets LP_DEAD on the high key of
>a multi-page index. It crashes without 0003 and gives the new error with it.


Hi,
Thanks for your work.
I have tested your patches.
With the v3 patch set, 
issues can still be triggered with brin_page_items(set_byte()......) using a 
comparable method.


  CREATE TABLE b2(a int);
  INSERT INTO b2 SELECT g FROM generate_series(1,1000) g;
  CREATE INDEX b2_brin ON b2 USING brin(a) WITH (pages_per_range = 1);


  SELECT brin_page_items(
    set_byte(set_byte(set_byte(set_byte(set_byte(
    set_byte(set_byte(set_byte(set_byte(
      get_raw_page('b2_brin', 2),
      24, 248), 25, 159), 26, 10), 27, 0),   
      8184, 0), 8185, 0), 8186, 0), 8187, 0), 
      8188, 31),    
    'b2_brin'::regclass);


Observed result:
  (1,0,1,f,f,f,f,"{24576 .. 0}")


This out-of-bounds data access triggers OOB reports under valgrind/ASan.
A SIGSEGV can likely be constructed using a similar approach.
Please take this into consideration.


Best regards,
Yilin Zhang