Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19508: pg_buffercache_pages() crashes the backend with an
 incompatible caller-supplied record definition
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: n.kalinin@postgrespro.ru
Reply-To: n.kalinin@postgrespro.ru, pgsql-bugs@lists.postgresql.org
Date: Thu, 04 Jun 2026 14:35:10 +0000
Message-ID: <19508-e5f188183279219b@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19508-e5f188183279219b%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19508
Logged by:          Nikita Kalinin
Email address:      n.kalinin@postgrespro.ru
PostgreSQL version: 19beta1
Operating system:   Fedora 44
Description:       =20

Hello,

It appears that pg_buffercache_pages() trusts a caller-supplied record
descriptor without verifying that the declared column types match the actual
values returned by the function.

The crash is reproducible on the current master branch with a fresh cluster
after installing the extension:

CREATE EXTENSION pg_buffercache;

SELECT *
FROM pg_buffercache_pages() AS p(
  bufferid integer,
  relfilenode oid,
  reltablespace oid,
  reldatabase oid,
  relforknumber smallint,
  relblocknumber bigint,
  isdirty text,
  usagecount smallint
)
LIMIT 1;

postgres=3D# select version();
                                                   version
---------------------------------------------------------------------------=
----------------------------------
 PostgreSQL 19beta1 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 16.1.1
20260515 (Red Hat 16.1.1-2), 64-bit
(1 row)

The only difference from the types documented for pg_buffercache_pages() is
that isdirty is declared as text instead of boolean.

git blame points to the following commit:

commit 257c8231bf97a77378f6fedb826b1243f0a41612 (HEAD)
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date:   Tue Apr 7 16:04:48 2026 +0300

    Modernize and optimize pg_buffercache_pages()


Backtrace:

#0  0x00000000004b2565 in VARATT_CAN_MAKE_SHORT (PTR=3D<optimized out>)
    at ../../../../src/include/varatt.h:419
#1  heap_compute_data_size (tupleDesc=3DtupleDesc@entry=3D0x3e5ba110,
    values=3Dvalues@entry=3D0x7ffd0dc219c0, isnull=3Disnull@entry=3D0x7ffd0=
dc219b4)
at heaptuple.c:239
#2  0x00000000004b3bff in heap_form_minimal_tuple
(tupleDescriptor=3D0x3e5ba110,
    values=3Dvalues@entry=3D0x7ffd0dc219c0, isnull=3Disnull@entry=3D0x7ffd0=
dc219b4,
extra=3Dextra@entry=3D0)
    at heaptuple.c:1434
#3  0x0000000000a6fa09 in tuplestore_putvalues (state=3D0x3e5cc0d8,
tdesc=3D<optimized out>,
    values=3Dvalues@entry=3D0x7ffd0dc219c0, isnull=3Disnull@entry=3D0x7ffd0=
dc219b4)
at tuplestore.c:791
#4  0x00007f180fa0447e in pg_buffercache_pages (fcinfo=3D<optimized out>)
    at pg_buffercache_pages.c:202
#5  0x00000000006b7e35 in ExecMakeTableFunctionResult (setexpr=3D0x3e5b9e98,
econtext=3D0x3e5b9d38,
    argContext=3D<optimized out>, expectedDesc=3D0x3e5ba110, randomAccess=
=3Dfalse)
at execSRF.c:235
#6  0x00000000006ccc57 in FunctionNext (node=3D0x3e5b9b28) at
nodeFunctionscan.c:95
#7  0x00000000006daf22 in ExecProcNode (node=3D0x3e5b9b28)
    at ../../../src/include/executor/executor.h:327
#8  ExecLimit (pstate=3D0x3e5b97b8) at nodeLimit.c:95
#9  0x00000000006ac39a in ExecProcNode (node=3D0x3e5b97b8)
    at ../../../src/include/executor/executor.h:327
#10 ExecutePlan (queryDesc=3D0x3e5d7d80, operation=3DCMD_SELECT,
sendTuples=3Dtrue, numberTuples=3D0,
    direction=3D<optimized out>, dest=3D0x3e5e11f8) at execMain.c:1736
#11 standard_ExecutorRun (queryDesc=3D0x3e5d7d80, direction=3D<optimized ou=
t>,
count=3D0)
    at execMain.c:377
#12 0x00000000008c61d8 in PortalRunSelect (portal=3Dportal@entry=3D0x3e52f1=
30,
    forward=3Dforward@entry=3Dtrue, count=3D0, count@entry=3D92233720368547=
75807,
    dest=3Ddest@entry=3D0x3e5e11f8) at pquery.c:917
#13 0x00000000008c78be in PortalRun (portal=3Dportal@entry=3D0x3e52f130,
    count=3Dcount@entry=3D9223372036854775807, isTopLevel=3DisTopLevel@entr=
y=3Dtrue,
    dest=3Ddest@entry=3D0x3e5e11f8, altdest=3Daltdest@entry=3D0x3e5e11f8,
qc=3Dqc@entry=3D0x7ffd0dc21e20)
    at pquery.c:761
#14 0x00000000008c3548 in exec_simple_query (
    query_string=3D0x3e48b800 "SELECT *\nFROM pg_buffercache_pages() AS p(\n
bufferid integer,\n  relfilenode oid,\n  reltablespace oid,\n  reldatabase
oid,\n  relforknumber smallint,\n  relblocknumber bigint,\n  isdirty text,\n
usagecoun"...) at postgres.c:1290
#15 0x00000000008c5021 in PostgresMain (dbname=3D<optimized out>,
username=3D<optimized out>)
    at postgres.c:4856
#16 0x00000000008bf01d in BackendMain (startup_data=3D<optimized out>,
    startup_data_len=3D<optimized out>) at backend_startup.c:124
#17 0x00000000007fefae in postmaster_child_launch (child_type=3D<optimized
out>, child_slot=3D1,
    startup_data=3Dstartup_data@entry=3D0x7ffd0dc22270,
startup_data_len=3Dstartup_data_len@entry=3D24,
    client_sock=3Dclient_sock@entry=3D0x7ffd0dc22290) at launch_backend.c:2=
68
#18 0x00000000008029b6 in BackendStartup (client_sock=3D0x7ffd0dc22290) at
postmaster.c:3627
#19 ServerLoop () at postmaster.c:1728
#20 0x0000000000804479 in PostmasterMain (argc=3Dargc@entry=3D3,
argv=3Dargv@entry=3D0x3e434fe0)
    at postmaster.c:1415
#21 0x00000000004a1c18 in main (argc=3D3, argv=3D0x3e434fe0) at main.c:231

For comparison, the same query executed on REL_18_STABLE is rejected with a
regular error:

ERROR:  function return row and query-specified return row do not match
DETAIL:  Returned type boolean at ordinal position 7, but query expects
text.