Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vi7ap-00FZYT-2F for pgsql-bugs@arkaria.postgresql.org; Tue, 20 Jan 2026 09:00:08 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1vi7ao-00HGaG-2T for pgsql-bugs@arkaria.postgresql.org; Tue, 20 Jan 2026 09:00:07 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vi42A-00G1Od-1l for pgsql-bugs@lists.postgresql.org; Tue, 20 Jan 2026 05:12:06 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vi427-001MPh-2c for pgsql-bugs@lists.postgresql.org; Tue, 20 Jan 2026 05:12:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Message-ID:Date:Reply-To:Cc:From:To:Subject: Content-Transfer-Encoding:MIME-Version:Content-Type:Sender:Content-ID: Content-Description:In-Reply-To:References; bh=cEjLao2hDuqBdwLRoeHcZ79XNazR4blbYnN4Iz7ytJU=; b=E6FwfLiXWbXGeH7RP6yOxp9E1z xIFyNsBhyW1zHwgbcGHEHuK9KswaipjGckll8fqLbiDatEZ1TfAeM0iC37PvCrCws1locZd2BsCQo RDYE2pbQvJWkn7JnuT5x8SqH1UCZMvnD98kM4xBi+xtfnw/P+K1X0P271JgP3HyM/DE3kv8XCPvTD MC/ZChHe1BIEmiBm2/9JahwGLCTj7w4gUxuUot7gNyhGRhXTQzX+FYeLM5wXqSdJgH21VPpIefFpP j9492OadHwtKZJCtJ1mhtIwWUoXLWbGK5XTzyxK+Y71VwsG8JUSxEmqUCMspszKQCtRABo/9dVfwJ x+D1N6UA==; Received: from wrigleys.postgresql.org ([2a02:16a8:dc51::60]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vi426-003yNG-39 for pgsql-bugs@lists.postgresql.org; Tue, 20 Jan 2026 05:12:04 +0000 Received: from localhost ([127.0.0.1] helo=wrigleys.postgresql.org) by wrigleys.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1vi426-006fDA-0u for pgsql-bugs@lists.postgresql.org; Tue, 20 Jan 2026 05:12:02 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Subject: BUG #19384: Server crash at textout To: pgsql-bugs@lists.postgresql.org From: PG Bug reporting form Cc: dllggyx@outlook.com Reply-To: dllggyx@outlook.com, pgsql-bugs@lists.postgresql.org Date: Tue, 20 Jan 2026 05:11:17 +0000 Message-ID: <19384-65ff412feef17f06@postgresql.org> X-Auto-Response-Suppress: All Auto-Submitted: auto-generated List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk The following bug has been logged on the website: Bug reference: 19384 Logged by: Yuxiao Guo Email address: dllggyx@outlook.com PostgreSQL version: 17.7 Operating system: Ubuntu 20.04 x86-64, docker image postgres:17.7 Description: =20 Hi, I found a crash in PostgreSQL. Here are the details: PoC: DROP TYPE IF EXISTS foo CASCADE; CREATE TYPE foo AS (a INT, b INT); BEGIN; DECLARE c CURSOR FOR SELECT (i, power(2, 30))::foo FROM generate_series(1,10) i; FETCH c; ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT; FETCH c; Stacktrace: #0 0x7ae1c818a00b (gsignal+0xcb) #1 0x7ae1c8169859 (abort+0x12b) #2 0x542fa7 (_ZN11__sanitizer5AbortEv+0x47) #3 0x5414d1 (_ZN11__sanitizer3DieEv+0xc1) #4 0x528a14 (_ZN6__asan19ScopedInErrorReportD2Ev+0x1c4) #5 0x52a5da (_ZN6__asan18ReportGenericErrorEmmmmbmjb+0x5ba) #6 0x523ef6 (__asan_memcpy+0x1d6) #7 0x17772d5 (textout+0x1b5) #8 0x1835834 (OutputFunctionCall+0x174) #9 0x167a568 (record_out+0x828) #10 0x1835834 (OutputFunctionCall+0x174) #11 0x595848 (printtup+0x958) #12 0x1336280 (RunFromStore+0x1d0) #13 0x1333ec0 (PortalRunSelect+0x150) #14 0x133321d (PortalRun+0x51d) #15 0x132f1de (exec_simple_query+0x146e) #16 0x1328627 (PostgresMain+0x2c57) #17 0x13192e4 (BackendMain+0xe4) #18 0x10a26c3 (postmaster_child_launch+0x193) #19 0x10adb91 (ServerLoop+0x4821) #20 0x10a76ec (PostmasterMain+0x241c) #21 0xd5c2b8 (main+0x458) #22 0x7ae1c816b083 (__libc_start_main+0xf3) #23 0x4a9c6e (_start+0x2e)