Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pnjNY-0006Ll-Vw for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:08:01 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pnjNX-0003xY-OV for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:07:59 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pmzyx-0004s0-E3 for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:39:35 +0000 Received: from zg8tndyumtaxlji0oc4xnzya.icoremail.net ([46.101.248.176]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pmzyt-0006os-SF for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:39:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mails.tsinghua.edu.cn; s=dkim; h=Received:From:To:Cc:Subject: Date:Message-ID:MIME-Version:Content-Type:Content-Language: Thread-Index; bh=cIXPxnzKn9Cpu+n3FF3IJ1jnI3Xtrq0G/J/pwdMEgqo=; b=lzsCU+oU1ENBOtcZSpm/G0Cp+P4VsinJZVHsExPSvm33tAQqcKD04046suNF3E xconm0Z53Gb3swSpmDmdqq5gcPXw2RkAy0FwNv0gPxmrzqKu0iCsJp/YqtSexSR2 Lkw/IqGxyhjYgeQML/nw9kQkkfI4hYAFsdvjnlfdadusA= Received: from LAPTOPJPQFQS7K (unknown [183.172.66.176]) by web3 (Coremail) with SMTP id ygQGZQDHSl49MDhk3lAdEw--.54328S2; Fri, 14 Apr 2023 00:39:25 +0800 (CST) From: To: Cc: , Subject: =?us-ascii?Q?4._PostgreSQL_Server_=28Address_Sanitizer_Enabled=29_Subproc?= =?us-ascii?Q?ess_Went_down_at_Function_'=5F=5Fasan=5Fmemcpy'?= Date: Fri, 14 Apr 2023 00:39:27 +0800 Message-ID: <00a901d96e26$8350bf20$89f23d60$@mails.tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00AA_01D96E69.9174E980" X-Mailer: Microsoft Outlook 16.0 Content-Language: zh-cn Thread-Index: AdluJk3zK8DYj/GvR6yK4iycEdhgEQ== X-CM-TRANSID: ygQGZQDHSl49MDhk3lAdEw--.54328S2 X-Coremail-Antispam: 1UD129KBjvJXoWxGry3WF1fKFyrKF17Jw1fJFb_yoWrZw13p3 sYka15Ary8XF1kZrsaqa1rur4fGFWkAF15ZrnrCrW7JFsxG3sagryqyFWavrZ0q3yj93W8 JayfJw1DZ3W7ZFUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQIb7Iv0xC_Cr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x2 0xvEncxIr21l5I8CrVAYj202j2C_Wr0_Ar1l5I8CrVAqjxCE14ACF2xKxwAqx4xG64kEw2 xG04xIwI0_Gr0_Xr1l5I8CrVCF0I0E4I0vr24lYx0E2Ix0cI8IcVAFwI0_Jrv_JF1lYx0E x4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwAKzV CY07xG64k0F24l7480Y4vEI4kI2Ix0rVAqx4xJMxkIecxEwVAFwVWUMxAIw28IcxkI7VAK I48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_JrI_JrWlx2IqxVCjr7 xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUXVWUAwCIc40Y0x0EwIxGrwCI42IY6xII jxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw2 0EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x02 67AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IUn7CzJUUUUU== X-CM-SenderInfo: him2jjo6pdxz3vow2x5qjk3toohg3hdfq/ List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multipart message in MIME format. ------=_NextPart_000_00AA_01D96E69.9174E980 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Description: PostgreSQL Server (Address Sanitizer Enabled) Subprocess Went down at Function '__asan_memcpy' PostgreSQL Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by Ubuntu clang version 12.0.1, 64-bit Discoverer: Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua University and Shuimuyulin ltd Email address: fjz22@mails.tsinghua.edu.cn , wuzy21@mails.tsinghua.edu.cn , ljiee@mail.tsinghua.edu.cn PoC: ```sql CREATE FUNCTION f1(cstring) RETURNS interval_tbl AS 'textin' LANGUAGE internal STRICT IMMUTABLE; CREATE FUNCTION interval_tbl_of(interval_tbl) RETURNS cstring AS 'textout' LANGUAGE internal STRICT IMMUTABLE; create type interval_tbl ( input = f1, output = interval_tbl_of, like = int8 ); SELECT interval_tbl_of('interval_tbl'::text::interval_tbl); ``` ASAN Report: ``` ==2890==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x625000041218,0x625000041224) and [0x62500004121c, 0x625000041228) overlap #0 0x519d74 in __asan_memcpy (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x519d74) #1 0x1bd1956 in text_to_cstring (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1bd1956) #2 0x1bd5515 in textout (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1bd5515) #3 0xe84bc4 in ExecInterpExpr (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xe84bc4) #4 0xe81ced in ExecInterpExprStillValid (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xe81ced) #5 0x13589b4 in ExecEvalExprSwitchContext (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x13589b4) #6 0x1358546 in evaluate_expr (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1358546) #7 0x135d9c4 in evaluate_function (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x135d9c4) #8 0x135b520 in simplify_function (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x135b520) #9 0x134afda in eval_const_expressions_mutator (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x134afda) #10 0x111caae in expression_tree_mutator (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x111caae) #11 0x1355113 in eval_const_expressions_mutator (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1355113) #12 0x111d807 in expression_tree_mutator (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x111d807) #13 0x1355113 in eval_const_expressions_mutator (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1355113) #14 0x1349342 in eval_const_expressions (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1349342) #15 0x12a58ff in preprocess_expression (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x12a58ff) #16 0x12a0185 in subquery_planner (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x12a0185) #17 0x129ba26 in standard_planner (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x129ba26) #18 0x129ae4b in planner (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x129ae4b) #19 0x16e1e65 in pg_plan_query (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e1e65) #20 0x16e2861 in pg_plan_queries (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e2861) #21 0x16e924c in exec_simple_query (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e924c) #22 0x16e7a62 in PostgresMain (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e7a62) #23 0x144c17a in BackendRun (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144c17a) #24 0x144ad84 in BackendStartup (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144ad84) #25 0x14481e5 in ServerLoop (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x14481e5) #26 0x1443e0e in PostmasterMain (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1443e0e) #27 0x106ebf1 in main (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x106ebf1) #28 0x7fc0c3cfb082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #29 0x49fc0d in _start (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x49fc0d) ``` ------=_NextPart_000_00AA_01D96E69.9174E980 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Description: = PostgreSQL Server (Address Sanitizer Enabled) Subprocess Went down at = Function ‘__asan_memcpy’

PostgreSQL = Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by = Ubuntu clang version 12.0.1, 64-bit

Discoverer: = Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua = University and Shuimuyulin ltd

Email = address: fjz22@mails.tsinghua.edu.cn  ,   wuzy21@mails.tsinghua.edu.cn&n= bsp; ,  = ljiee@mail.tsinghua.edu.cn

 

PoC:

```sql

CREATE = FUNCTION f1(cstring)

   = RETURNS interval_tbl

   = AS 'textin'

   = LANGUAGE internal STRICT IMMUTABLE;

CREATE = FUNCTION interval_tbl_of(interval_tbl)

   = RETURNS cstring

   = AS 'textout'

   = LANGUAGE internal STRICT IMMUTABLE;

create type = interval_tbl (

  &= nbsp; input =3D f1,

  &= nbsp; output =3D interval_tbl_of,

  &= nbsp; like =3D int8

);=

SELECT = interval_tbl_of('interval_tbl'::text::interval_tbl);

```

 

ASAN = Report:

```

=3D=3D2890=3D= =3DERROR: AddressSanitizer: memcpy-param-overlap: memory ranges = [0x625000041218,0x625000041224) and [0x62500004121c, 0x625000041228) = overlap

  &= nbsp; #0 0x519d74 in __asan_memcpy = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x519d74)

  &= nbsp; #1 0x1bd1956 in text_to_cstring = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1bd1956)

  &= nbsp; #2 0x1bd5515 in textout = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1bd5515)

  &= nbsp; #3 0xe84bc4 in ExecInterpExpr = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xe84bc4)

  &= nbsp; #4 0xe81ced in ExecInterpExprStillValid = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xe81ced)

  &= nbsp; #5 0x13589b4 in ExecEvalExprSwitchContext = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x13589b4)

  &= nbsp; #6 0x1358546 in evaluate_expr = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1358546)

  &= nbsp; #7 0x135d9c4 in evaluate_function = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x135d9c4)

  &= nbsp; #8 0x135b520 in simplify_function = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x135b520)

  &= nbsp; #9 0x134afda in eval_const_expressions_mutator = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x134afda)

  &= nbsp; #10 0x111caae in expression_tree_mutator = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x111caae)

  &= nbsp; #11 0x1355113 in eval_const_expressions_mutator = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1355113)

  &= nbsp; #12 0x111d807 in expression_tree_mutator = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x111d807)

  &= nbsp; #13 0x1355113 in eval_const_expressions_mutator = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1355113)

  &= nbsp; #14 0x1349342 in eval_const_expressions = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1349342)

  &= nbsp; #15 0x12a58ff in preprocess_expression = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x12a58ff)

  &= nbsp; #16 0x12a0185 in subquery_planner = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x12a0185)

  &= nbsp; #17 0x129ba26 in standard_planner = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x129ba26)

  &= nbsp; #18 0x129ae4b in planner = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x129ae4b)

  &= nbsp; #19 0x16e1e65 in pg_plan_query = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e1e65)

  &= nbsp; #20 0x16e2861 in pg_plan_queries = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e2861)

  &= nbsp; #21 0x16e924c in exec_simple_query = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e924c)

  &= nbsp; #22 0x16e7a62 in PostgresMain = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e7a62)

  &= nbsp; #23 0x144c17a in BackendRun = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144c17a)

  &= nbsp; #24 0x144ad84 in BackendStartup = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144ad84)

  &= nbsp; #25 0x14481e5 in ServerLoop = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x14481e5)

  &= nbsp; #26 0x1443e0e in PostmasterMain = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1443e0e)

  &= nbsp; #27 0x106ebf1 in main = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x106ebf1)

  &= nbsp; #28 0x7fc0c3cfb082 in __libc_start_main = /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16<= /span>

  &= nbsp; #29 0x49fc0d in _start = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x49fc0d)

```

 

------=_NextPart_000_00AA_01D96E69.9174E980--