Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19438: segfault with temp_file_limit inside cursor
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: kuzmin.db4@gmail.com
Reply-To: kuzmin.db4@gmail.com, pgsql-bugs@lists.postgresql.org
Date: Wed, 25 Mar 2026 13:27:49 +0000
Message-ID: <19438-9d37b179c56d43aa@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: <https://www.postgresql.org/message-id/19438-9d37b179c56d43aa%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19438
Logged by:          Dmitriy Kuzmin
Email address:      kuzmin.db4@gmail.com
PostgreSQL version: 14.22
Operating system:   Rocky Linux 8.10 (Green Obsidian)
Description:       =20

Greetings

I experimented with setting temp_file_limit within a cursor and discovered a
segmentation fault under certain circumstances.
The issue exist in the current minors of 14 and 15 (14.22 and 15.17), but I
was unable to reproduce it in version 16 or higher.

To reproduce, simply run the following code.

begin;
declare cur1 cursor for select c, c c2  from generate_series(0, 1000000)
x(c) order by c;
\o /dev/null
fetch all from cur1;
set temp_file_limit TO '1MB';
fetch backward all from cur1;
rollback ;

Logs:
2026-03-25 16:24:58.264 MSK [3321241] ERROR:  temporary file size exceeds
temp_file_limit (1024kB)
2026-03-25 16:24:58.264 MSK [3321241] STATEMENT:  fetch backward all from
cur1;
2026-03-25 16:24:58.338 MSK [3320934] LOG:  server process (PID 3321241) was
terminated by signal 11: Segmentation fault
2026-03-25 16:24:58.338 MSK [3320934] DETAIL:  Failed process was running:
rollback ;
2026-03-25 16:24:58.338 MSK [3320934] LOG:  terminating any other active
server processes

Backtrace on pastebin(postgresql 14.22): https://pastebin.com/2srPbzhN
Backtrace(postgresql 14.22)

[New LWP 3320966]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `postgres: postgres postgres [local]'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  pfree (pointer=3D0x2d81538) at mcxt.c:1202
1202            context->methods->free_p(context, pointer);
#0  pfree (pointer=3D0x2d81538) at mcxt.c:1202
        context =3D 0x0
#1  0x000000000095399f in tuplestore_end (state=3D0x2d81318) at
tuplestore.c:462
        i =3D 0
#2  0x0000000000946920 in PortalDrop (portal=3D0x2ccf7f8,
isTopCommit=3D<optimized out>) at portalmem.c:585
        oldcontext =3D 0x2c6c930
        __func__ =3D "PortalDrop"
#3  0x0000000000946a50 in CreatePortal (name=3Dname@entry=3D0xaa970d "",
allowDup=3DallowDup@entry=3Dtrue, dupSilent=3DdupSilent@entry=3Dtrue) at
portalmem.c:193
        portal =3D 0x2ccf7f8
        __func__ =3D "CreatePortal"
#4  0x0000000000801116 in exec_simple_query (query_string=3D0x2c6ca48
"rollback ;") at postgres.c:1124
        snapshot_set =3D false
        per_parsetree_context =3D 0x0
        plantree_list =3D 0x2c6d7d0
        parsetree =3D 0x2c6d450
        commandTag =3D CMDTAG_ROLLBACK
        qc =3D {commandTag =3D CMDTAG_UNKNOWN, nprocessed =3D 1064392740122=
972416}
        querytree_list =3D <optimized out>
        portal =3D <optimized out>
        receiver =3D <optimized out>
        format =3D 0
        parsetree_item__state =3D {l =3D 0x2c6d480, i =3D 0}
        dest =3D DestRemote
        oldcontext =3D 0x2d22810
        parsetree_list =3D 0x2c6d480
        parsetree_item =3D <optimized out>
        save_log_statement_stats =3D false
        was_logged =3D false
        use_implicit_block =3D false
        msec_str =3D
"Z\000\000\000\000\000\000\000Q\000\000\000\000\000\000\000\370\227\311\002=
\000\000\000\000\267\360\222\000\000\000\000"
        __func__ =3D "exec_simple_query"
#5  0x0000000000802a6d in PostgresMain (argc=3Dargc@entry=3D1,
argv=3Dargv@entry=3D0x7ffcd5351a90, dbname=3D<optimized out>, username=3D<o=
ptimized
out>) at postgres.c:4571
        query_string =3D 0x2c6ca48 "rollback ;"
        firstchar =3D <optimized out>
        input_message =3D {data =3D 0x2c6ca48 "rollback ;", len =3D 11, max=
len =3D
1024, cursor =3D 11}
        local_sigjmp_buf =3D {{__jmpbuf =3D {140723885512688,
7291976700258799160, 46766072, 0, 3, 582, -7292484179921744328,
7291977799450480184}, __mask_was_saved =3D 1, __saved_mask =3D {__val =3D
{4194304, 140723885518811, 0, 0, 140723885513328, 140321394626256,
1064392740122972416, 206158430232, 9872339, 206158430240, 140723885513248,
140723885513056, 1064392740122972416, 46728512, 0, 11180896}}}}
        send_ready_for_query =3D false
        idle_in_transaction_timeout_enabled =3D false
        idle_session_timeout_enabled =3D false
        __func__ =3D "PostgresMain"
#6  0x00000000007816ca in BackendRun (port=3D<optimized out>, port=3D<optim=
ized
out>) at postmaster.c:4543
        av =3D {0x972bd4 "postgres", 0x0}
        ac =3D 1
        av =3D <optimized out>
        ac =3D <optimized out>
#7  BackendStartup (port=3D<optimized out>) at postmaster.c:4265
        bn =3D <optimized out>
        pid =3D <optimized out>
        bn =3D <optimized out>
        pid =3D <optimized out>
        __func__ =3D "BackendStartup"
        __errno_location =3D <optimized out>
        __errno_location =3D <optimized out>
        save_errno =3D <optimized out>
        __errno_location =3D <optimized out>
        __errno_location =3D <optimized out>
#8  ServerLoop () at postmaster.c:1752
        port =3D <optimized out>
        i =3D <optimized out>
        rmask =3D {fds_bits =3D {256, 0 <repeats 15 times>}}
        selres =3D <optimized out>
        now =3D <optimized out>
        readmask =3D {fds_bits =3D {960, 0 <repeats 15 times>}}
        nSockets =3D <optimized out>
        last_lockfile_recheck_time =3D 1774444257
        last_touch_time =3D 1774444257
        __func__ =3D "ServerLoop"
#9  0x0000000000782539 in PostmasterMain (argc=3Dargc@entry=3D3,
argv=3Dargv@entry=3D0x2c65120) at postmaster.c:1424
        opt =3D <optimized out>
        status =3D <optimized out>
        userDoption =3D <optimized out>
        listen_addr_saved =3D true
        i =3D <optimized out>
        output_config_variable =3D <optimized out>
        __func__ =3D "PostmasterMain"
#10 0x0000000000500bde in main (argc=3D3, argv=3D0x2c65120) at main.c:211
No locals.