Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19468: Prevent SIGSEGV on FETCH after ALTER TYPE of cursor rowtype
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: haogangmao@gmail.com
Reply-To: haogangmao@gmail.com, pgsql-bugs@lists.postgresql.org
Date: Mon, 27 Apr 2026 09:48:53 +0000
Message-ID: <19468-f4d360e16882e6c0@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: <https://www.postgresql.org/message-id/19468-f4d360e16882e6c0%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19468
Logged by:          HaoGang Mao
Email address:      haogangmao@gmail.com
PostgreSQL version: 17.3
Operating system:   OS: Linux (Docker)
Description:       =20

Summary:
PostgreSQL crashes with SIGSEGV when a cursor is open over a composite
type and the type is modified via ALTER TYPE during the same transaction,
followed by a second FETCH.

Reproduction steps (minimal):
  CREATE TYPE foo AS (a INT, b INT);
  BEGIN;
  DECLARE c CURSOR FOR
    SELECT (i, power(2, 30))::foo
    FROM generate_series(1,10) i;
  FETCH c;
  ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
  FETCH c;
  COMMIT;

Expected: Error message (type modified during active cursor)
Actual:   Server process terminated with signal 11 (Segmentation fault)

Confirmed environment:
  PostgreSQL 18.3, built from source with --enable-cassert --enable-debug
  Docker image: sqleek-pg18-debug:18.3
  Reproduction / stack script: report/postgres/get_stack3.sh
  Full stack output: report/postgres/crash_stack4.txt

Server log:
  client backend (PID 58) was terminated by signal 11: Segmentation fault
  Failed process was running: FETCH c;

GDB backtrace (trimmed):
  Program received signal SIGSEGV, Segmentation fault.
  #0  0x00007a7236074c60 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #1  text_to_cstring(t=3D0x58365637774c) at varlena.c:234
      len =3D 268435452
  #2  textout(fcinfo=3D0x7ffc86929ea0) at varlena.c:603
  #3  FunctionCall1Coll(flinfo=3D0x5836562990e8, collation=3D0,
                        arg1=3D96990397953868) at fmgr.c:1139
  #4  OutputFunctionCall(flinfo=3D0x5836562990e8,
                         val=3D96990397953868) at fmgr.c:1685
  #5  record_out(fcinfo=3D0x7ffc8692a040) at rowtypes.c:435
      column_type =3D 25
      attr =3D 96990397953868
      tupdesc =3D 0x7a722c7562a8
      ncolumns =3D 2
      i =3D 1
  #8  printtup(slot=3D0x583656298ff8, self=3D0x58365626f9c0)
      at printtup.c:360
  #9  RunFromStore(portal=3D0x5836562ee740,
                   direction=3DForwardScanDirection, count=3D0,
                   dest=3D0x58365626f9c0) at pquery.c:1094
  #10 PortalRunSelect(portal=3D0x5836562ee740, forward=3Dtrue,
                      count=3D0, dest=3D0x58365626f9c0) at pquery.c:917
  #11 PortalRun(portal=3D0x5836562ee740,
                count=3D9223372036854775807, isTopLevel=3Dtrue,
                dest=3D0x58365626f9c0, altdest=3D0x58365626f9c0,
                qc=3D0x7ffc8692a3c0) at pquery.c:765
  #12 exec_simple_query(query_string=3D0x58365626eb80 "FETCH c;")
      at postgres.c:1273
  #13 PostgresMain(dbname=3D0x5836562a7f38 "postgres",
                   username=3D0x5836562a7f20 "pguser") at postgres.c:4766

Stack note:
The crash happens while returning the second FETCH result. record_out()
uses the modified composite type output path and calls textout() on a
value that still has the old INT representation, leading to an invalid
text datum length before the SIGSEGV.

psql output:
  CREATE TYPE
  BEGIN
  DECLARE CURSOR
        row
  ----------------
   (1,1073741824)
  (1 row)

  ALTER TYPE
  psql:/tmp/trigger.sql:14: server closed the connection unexpectedly
  psql:/tmp/trigger.sql:14: error: connection to server was lost

Hypothesis:
The cursor holds a reference to the tuple descriptor for type "foo".
After ALTER TYPE modifies the type, the descriptor may be invalidated
while the cursor still holds a dangling pointer to it. The second FETCH
dereferences data using the new descriptor/output function metadata.