Commit
108d2adb9e missed updating a few places in the jsonb code
that rely on signed integer wrapping for correctness. These can
also be fixed by using pg_abs_s32() to negate a signed integer
(that is known to be negative) for comparison with an unsigned
integer.
Reported-by: Alexander Lakhin
Discussion: https://postgr.es/m/
bfff906f-300d-81ea-83b7-
f2c93845e7f2%40gmail.com
{
uint32 nelements = JB_ROOT_COUNT(jb);
- if (-element > nelements)
+ if (pg_abs_s32(element) > nelements)
PG_RETURN_NULL();
else
element += nelements;
if (idx < 0)
{
- if (-idx > n)
+ if (pg_abs_s32(idx) > n)
idx = n;
else
idx = n + idx;