Skip to content

Fix int overflow in Arrow text body buffer computation#9807

Open
akuzm wants to merge 1 commit into
mainfrom
aku/body-text
Open

Fix int overflow in Arrow text body buffer computation#9807
akuzm wants to merge 1 commit into
mainfrom
aku/body-text

Conversation

@akuzm
Copy link
Copy Markdown
Member

@akuzm akuzm commented May 13, 2026

The PG text values can be up to 1GB in size, so the computation for extending the Arrow text body buffer could overflow. Switch it to use the Size type.

The PG text values can be up to 1GB in size, so the computation for
extending the Arrow text body buffer could overflow. Switch it to use
the Size type.
@akuzm akuzm requested a review from a team May 13, 2026 13:58
@github-actions github-actions Bot requested review from antekresic and svenklemm May 13, 2026 13:59
@github-actions
Copy link
Copy Markdown

@antekresic, @svenklemm: please review this pull request.

Powered by pull-review

@akuzm akuzm added bug llm-fuzzer Issue fixed found by llm-fuzzer labels May 13, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented May 13, 2026

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
tsl/src/nodes/vector_agg/exec.c 50.00% 0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

);
select count(compress_chunk(c)) from show_chunks('t_textoverflow') c;

set timescaledb.debug_require_vector_agg to 'require';
Copy link
Copy Markdown
Member

@natalya-aksman natalya-aksman May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got LLM Fuzzer repro and error message as well and after applying similar fix but on a different repro I get this (see repro here: https://github.com/timescale/timescaledb/actions/runs/25753178490)

    SELECT count(text_col || repeat('x', 2000000)) FROM t_text_overflow;
ERROR:  invalid memory alloc request size 2220001281

Could we please also check the repro in the link after this fix?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, looks like this needs more work... I'll add this reproducer too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug llm-fuzzer Issue fixed found by llm-fuzzer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants