Re: [PATCH] bms_prev_member() can read beyond the end of the array of allocated words

Greg Burd <greg@burd.me> writes:
> Well, that was rushed.  Apologies.

I was thinking something more like

     /* transform -1 to the highest possible bit we could have set */
     if (prevbit == -1)
         prevbit = a->nwords * BITS_PER_BITMAPWORD - 1;
     else
+    {
+        Assert(prevbit > 0 && prevbit < a->nwords * BITS_PER_BITMAPWORD);
         prevbit--;
+    }

Admittedly, this doesn't bother to check sanity of prevbit when
a == NULL, but I don't think doing so is useful enough to contort
the logic for it.

            regards, tom lane