Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19492: intarray: fix variable stats leak in _int_matchsel
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: zengman@halodbtech.com
Reply-To: zengman@halodbtech.com, pgsql-bugs@lists.postgresql.org
Date: Sun, 24 May 2026 05:13:05 +0000
Message-ID: <19492-ddcd0e22399ef85a@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19492-ddcd0e22399ef85a%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19492
Logged by:          Man Zeng
Email address:      zengman@halodbtech.com
PostgreSQL version: 18.4
Operating system:   24.04.1-Ubuntu
Description:       =20

Hi all,

While investigating the intarray contrib module, I noticed a variable
stats leak in _int_matchsel().

When vardata.vartype !=3D INT4ARRAYOID, the function returns
DEFAULT_EQ_SEL early without releasing the variable stats previously
acquired via examine_variable(). This causes a memory leak in the
current memory context.

The fix is straightforward: add ReleaseVariableStats(vardata) before
the early return.

Steps to reproduce:
```sql
postgres@zxm-VMware-Virtual-Platform:~/code/postgres/contrib$ psql
psql (19devel)
Type "help" for help.

postgres=3D# CREATE EXTENSION intarray;
CREATE EXTENSION
postgres=3D# CREATE OR REPLACE FUNCTION my_text_eq(a text, b text) RETURNS
boolean AS $$
BEGIN
    RETURN a =3D b;
END;
$$ LANGUAGE plpgsql;
CREATE FUNCTION
postgres=3D# CREATE OPERATOR %% (
    LEFTARG =3D text,
    RIGHTARG =3D text,
    FUNCTION =3D my_text_eq,
    RESTRICT =3D _int_matchsel
);
CREATE OPERATOR
postgres=3D# CREATE TEMP TABLE test_vuln (t text);
CREATE TABLE
postgres=3D# INSERT INTO test_vuln SELECT md5(i::text) FROM generate_series=
(1,
1000) i;
ANALYZE test_vuln;
INSERT 0 1000
ANALYZE
postgres=3D# EXPLAIN (COSTS ON) SELECT * FROM test_vuln WHERE t %%
'test'::text;
2026-05-20 23:47:42.257 CST [11370] WARNING:  resource was not closed: cache
pg_statistic (73), tuple 9/33 has count 1
WARNING:  resource was not closed: cache pg_statistic (73), tuple 9/33 has
count 1
                         QUERY PLAN
------------------------------------------------------------
 Seq Scan on test_vuln  (cost=3D0.00..269.00 rows=3D5 width=3D33)
   Filter: (t %% 'test'::text)
(2 rows)

postgres=3D#
```

SQL:
```sql
CREATE EXTENSION intarray;
CREATE OR REPLACE FUNCTION my_text_eq(a text, b text) RETURNS boolean AS $$
BEGIN
    RETURN a =3D b;
END;
$$ LANGUAGE plpgsql;
CREATE OPERATOR %% (
    LEFTARG =3D text,
    RIGHTARG =3D text,
    FUNCTION =3D my_text_eq,
    RESTRICT =3D _int_matchsel
);
CREATE TEMP TABLE test_vuln (t text);
INSERT INTO test_vuln SELECT md5(i::text) FROM generate_series(1, 1000) i;
ANALYZE test_vuln;
EXPLAIN (COSTS ON) SELECT * FROM test_vuln WHERE t %% 'test'::text;
```

Regards,
Man Zeng