Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1sp90h-00GxhP-Ns
	for pgsql-bugs@arkaria.postgresql.org; Fri, 13 Sep 2024 16:19:04 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1sp90g-006U1H-EA
	for pgsql-bugs@arkaria.postgresql.org; Fri, 13 Sep 2024 16:19:02 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1sp90g-006U19-4b
	for pgsql-bugs@lists.postgresql.org; Fri, 13 Sep 2024 16:19:02 +0000
Received: from sss.pgh.pa.us ([68.162.161.243])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1sp90d-000zTw-6T
	for pgsql-bugs@lists.postgresql.org; Fri, 13 Sep 2024 16:19:00 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 48DGIwa3103143;
	Fri, 13 Sep 2024 12:18:58 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: fuboat@outlook.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18617: PostgreSQL Server Subprocess Crashes by the XPATH
 Function Expression with Crafted Arguments
In-reply-to: <18617-1cee4d2ed1f4e7ae@postgresql.org>
References: <18617-1cee4d2ed1f4e7ae@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Fri, 13 Sep 2024 12:31:20 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <103141.1726244338.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 13 Sep 2024 12:18:58 -0400
Message-ID: <103142.1726244338@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/103142.1726244338%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> SELECT XPATH(REPEAT('(', 100000), '<root/>');

> GDB Backtrace (It seems to be a stack overflow):

Yeah, with debug symbols it looks like

(gdb) bt
#0  0x00007f14666a177d in xmlXPathCompMultiplicativeExpr (ctxt=3D0x2b79ab0=
) at ../xpath.c:10864
#1  0x00007f14666a1ee4 in xmlXPathCompAdditiveExpr (ctxt=3D0x2b79ab0) at .=
./xpath.c:11016
#2  xmlXPathCompRelationalExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10943
#3  xmlXPathCompEqualityExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10985
#4  xmlXPathCompAndExpr (ctxt=3D0x2b79ab0) at ../xpath.c:11016
#5  xmlXPathCompileExpr (ctxt=3D0x2b79ab0, sort=3D1) at ../xpath.c:11042
#6  0x00007f14666a071a in xmlXPathCompPrimaryExpr (ctxt=3D<optimized out>)=
 at ../xpath.c:10528
#7  xmlXPathCompFilterExpr (ctxt=3D<optimized out>) at ../xpath.c:10562
#8  xmlXPathCompPathExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:107=
69
#9  0x00007f14666a15b6 in xmlXPathCompUnionExpr (ctxt=3D0x2b79ab0) at ../x=
path.c:10839
#10 xmlXPathCompUnaryExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:10=
839
#11 0x00007f14666a1782 in xmlXPathCompMultiplicativeExpr (ctxt=3D0x2b79ab0=
) at ../xpath.c:10864
#12 0x00007f14666a1ee4 in xmlXPathCompAdditiveExpr (ctxt=3D0x2b79ab0) at .=
./xpath.c:11016
#13 xmlXPathCompRelationalExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10943
#14 xmlXPathCompEqualityExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10985
#15 xmlXPathCompAndExpr (ctxt=3D0x2b79ab0) at ../xpath.c:11016
#16 xmlXPathCompileExpr (ctxt=3D0x2b79ab0, sort=3D1) at ../xpath.c:11042
#17 0x00007f14666a071a in xmlXPathCompPrimaryExpr (ctxt=3D<optimized out>)=
 at ../xpath.c:10528
#18 xmlXPathCompFilterExpr (ctxt=3D<optimized out>) at ../xpath.c:10562
#19 xmlXPathCompPathExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:107=
69
#20 0x00007f14666a15b6 in xmlXPathCompUnionExpr (ctxt=3D0x2b79ab0) at ../x=
path.c:10839
#21 xmlXPathCompUnaryExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:10=
839
#22 0x00007f14666a1782 in xmlXPathCompMultiplicativeExpr (ctxt=3D0x2b79ab0=
) at ../xpath.c:10864
#23 0x00007f14666a1ee4 in xmlXPathCompAdditiveExpr (ctxt=3D0x2b79ab0) at .=
./xpath.c:11016
#24 xmlXPathCompRelationalExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10943
#25 xmlXPathCompEqualityExpr (ctxt=3D0x2b79ab0) at ../xpath.c:10985
#26 xmlXPathCompAndExpr (ctxt=3D0x2b79ab0) at ../xpath.c:11016
#27 xmlXPathCompileExpr (ctxt=3D0x2b79ab0, sort=3D1) at ../xpath.c:11042
#28 0x00007f14666a071a in xmlXPathCompPrimaryExpr (ctxt=3D<optimized out>)=
 at ../xpath.c:10528
#29 xmlXPathCompFilterExpr (ctxt=3D<optimized out>) at ../xpath.c:10562
#30 xmlXPathCompPathExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:107=
69
#31 0x00007f14666a15b6 in xmlXPathCompUnionExpr (ctxt=3D0x2b79ab0) at ../x=
path.c:10839
#32 xmlXPathCompUnaryExpr (ctxt=3Dctxt@entry=3D0x2b79ab0) at ../xpath.c:10=
839
#33 0x00007f14666a1782 in xmlXPathCompMultiplicativeExpr (ctxt=3D0x2b79ab0=
) at ../xpath.c:10864
#34 0x00007f14666a1ee4 in xmlXPathCompAdditiveExpr (ctxt=3D0x2b79ab0) at .=
./xpath.c:11016
... etc etc...

Fundamentally, this is a libxml2 bug that we can't do much about.
There are various hard-wired limits on document complexity in libxml2,
but they don't seem to be trapping this particular case, and we have
no ability to adjust them anyway.  You might try filing a bug with
the libxml2 authors.

			regards, tom lane