pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17300: Server crashes on deserializing text multirange
5+ messages / 3 participants
[nested] [flat]
* BUG #17300: Server crashes on deserializing text multirange
@ 2021-11-27 18:00 PG Bug reporting form <noreply@postgresql.org>
2021-12-01 22:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 5+ messages in thread
From: PG Bug reporting form @ 2021-11-27 18:00 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: exclusion@gmail.com
The following bug has been logged on the website:
Bug reference: 17300
Logged by: Alexander Lakhin
Email address: exclusion@gmail.com
PostgreSQL version: 14.1
Operating system: Ubuntu 20.04
Description:
The following query:
select ('[\"\\\\\",\"\\\\' || repeat('a', 200) ||
'\"]')::textrange::textmultirange
leads to the server crash with the following stacktrace:
Core was generated by `postgres: law regression [local] SELECT
'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __memmove_avx_unaligned_erms () at
../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:440
440 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such
file or directory.
(gdb) bt
#0 __memmove_avx_unaligned_erms () at
../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:440
#1 0x000055d4175fb385 in multirange_get_range (rangetyp=0x55d4195096c0,
multirange=0x55d419513fc8, i=0)
at multirangetypes.c:723
#2 0x000055d4175fba26 in multirange_deserialize (rangetyp=0x55d4195096c0,
multirange=0x55d419513fc8,
range_count=0x7ffec30cb3bc, ranges=0x7ffec30cb3c8) at
multirangetypes.c:830
#3 0x000055d4175fa03c in multirange_out (fcinfo=0x7ffec30cb450) at
multirangetypes.c:311
#4 0x000055d4176fb1de in FunctionCall1Coll (flinfo=0x55d419512a20,
collation=0, arg1=94369446182856) at fmgr.c:1138
#5 0x000055d4176fc79c in OutputFunctionCall (flinfo=0x55d419512a20,
val=94369446182856) at fmgr.c:1575
#6 0x000055d416fd2bff in printtup (slot=0x55d419511978,
self=0x55d41951ff18) at printtup.c:357
#7 0x000055d4172b8ac9 in ExecutePlan (estate=0x55d419511420,
planstate=0x55d419511658, use_parallel_mode=false,
operation=CMD_SELECT, sendTuples=true, numberTuples=0,
direction=ForwardScanDirection, dest=0x55d41951ff18,
execute_once=true) at execMain.c:1582
#8 0x000055d4172b6578 in standard_ExecutorRun (queryDesc=0x55d4194677d0,
direction=ForwardScanDirection, count=0,
execute_once=true) at execMain.c:361
#9 0x000055d4172b6363 in ExecutorRun (queryDesc=0x55d4194677d0,
direction=ForwardScanDirection, count=0,
execute_once=true) at execMain.c:305
#10 0x000055d417533510 in PortalRunSelect (portal=0x55d4194a9110,
forward=true, count=0, dest=0x55d41951ff18)
at pquery.c:921
#11 0x000055d417533134 in PortalRun (portal=0x55d4194a9110,
count=9223372036854775807, isTopLevel=true, run_once=true,
dest=0x55d41951ff18, altdest=0x55d41951ff18, qc=0x7ffec30cb870) at
pquery.c:765
#12 0x000055d41752c01e in exec_simple_query (
query_string=0x55d4194453b0 "select ('[\\\"\\\\\\\\\\\",\\\"\\\\\\\\' ||
repeat('a', 200) || '\\\"]')::textrange::textmultirange;") at
postgres.c:1214
#13 0x000055d417530f0d in PostgresMain (argc=1, argv=0x7ffec30cba90,
dbname=0x55d419470ff8 "regression",
username=0x55d419470fd8 "law") at postgres.c:4486
#14 0x000055d41745579c in BackendRun (port=0x55d419469f10) at
postmaster.c:4530
#15 0x000055d417454ff7 in BackendStartup (port=0x55d419469f10) at
postmaster.c:4252
#16 0x000055d417450dec in ServerLoop () at postmaster.c:1745
#17 0x000055d417450549 in PostmasterMain (argc=8, argv=0x55d41943f620) at
postmaster.c:1417
#18 0x000055d41733fd34 in main (argc=8, argv=0x55d41943f620) at main.c:209
The query without casting to the multirange type:
select ('[\"\\\\\",\"\\\\' || repeat('a', 200) || '\"]')::textrange
doesn't fail.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17300: Server crashes on deserializing text multirange
2021-11-27 18:00 BUG #17300: Server crashes on deserializing text multirange PG Bug reporting form <noreply@postgresql.org>
@ 2021-12-01 22:39 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-12-06 19:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: Tom Lane @ 2021-12-01 22:39 UTC (permalink / raw)
To: Alexander Korotkov <aekorotkov@gmail.com>; Paul A Jungwirth <pj@illuminatedcomputing.com>; +Cc: exclusion@gmail.com; pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> The following query:
> select ('[\"\\\\\",\"\\\\' || repeat('a', 200) ||
> '\"]')::textrange::textmultirange
> leads to the server crash with the following stacktrace:
I think the problem here is that the range bound values inside the
multirange are supposed to be aligned (at least, write_multirange_data
thinks so) but multirange_get_range isn't accounting for the alignment
padding between the two values it extracts. In this example that
causes it to extract an insane length for the second value.
If so, this would indicate extremely slipshod testing of the multirange
stuff, because the breakage is necessarily reached by multirange_out.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17300: Server crashes on deserializing text multirange
2021-11-27 18:00 BUG #17300: Server crashes on deserializing text multirange PG Bug reporting form <noreply@postgresql.org>
2021-12-01 22:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Tom Lane <tgl@sss.pgh.pa.us>
@ 2021-12-06 19:39 ` Alexander Korotkov <aekorotkov@gmail.com>
2021-12-11 01:48 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: Alexander Korotkov @ 2021-12-06 19:39 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Paul A Jungwirth <pj@illuminatedcomputing.com>; Alexander Law <exclusion@gmail.com>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Thu, Dec 2, 2021 at 1:39 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> PG Bug reporting form <noreply@postgresql.org> writes:
> > The following query:
>
> > select ('[\"\\\\\",\"\\\\' || repeat('a', 200) ||
> > '\"]')::textrange::textmultirange
>
> > leads to the server crash with the following stacktrace:
>
> I think the problem here is that the range bound values inside the
> multirange are supposed to be aligned (at least, write_multirange_data
> thinks so) but multirange_get_range isn't accounting for the alignment
> padding between the two values it extracts. In this example that
> causes it to extract an insane length for the second value.
>
> If so, this would indicate extremely slipshod testing of the multirange
> stuff, because the breakage is necessarily reached by multirange_out.
Sorry for the delay. I'm going to fix this in the next couple of days.
------
Regards,
Alexander Korotkov
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17300: Server crashes on deserializing text multirange
2021-11-27 18:00 BUG #17300: Server crashes on deserializing text multirange PG Bug reporting form <noreply@postgresql.org>
2021-12-01 22:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Tom Lane <tgl@sss.pgh.pa.us>
2021-12-06 19:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
@ 2021-12-11 01:48 ` Alexander Korotkov <aekorotkov@gmail.com>
2021-12-13 14:28 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: Alexander Korotkov @ 2021-12-11 01:48 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Paul A Jungwirth <pj@illuminatedcomputing.com>; Alexander Law <exclusion@gmail.com>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Mon, Dec 6, 2021 at 10:39 PM Alexander Korotkov <aekorotkov@gmail.com> wrote:
> On Thu, Dec 2, 2021 at 1:39 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > PG Bug reporting form <noreply@postgresql.org> writes:
> > > The following query:
> >
> > > select ('[\"\\\\\",\"\\\\' || repeat('a', 200) ||
> > > '\"]')::textrange::textmultirange
> >
> > > leads to the server crash with the following stacktrace:
> >
> > I think the problem here is that the range bound values inside the
> > multirange are supposed to be aligned (at least, write_multirange_data
> > thinks so) but multirange_get_range isn't accounting for the alignment
> > padding between the two values it extracts. In this example that
> > causes it to extract an insane length for the second value.
> >
> > If so, this would indicate extremely slipshod testing of the multirange
> > stuff, because the breakage is necessarily reached by multirange_out.
>
> Sorry for the delay. I'm going to fix this in the next couple of days.
The proposed patch fixes the patch (and adds some minimal testing for
it). I'm going to push it if no objections (backpatch to v14).
------
Regards,
Alexander Korotkov
Attachments:
[application/octet-stream] multirange_fix_alignment.patch (5.9K, ../../CAPpHfdtPFbiUtKq7gB1=mMQZz-RaXnZ3=sEtdOVKByO0E58s=A@mail.gmail.com/2-multirange_fix_alignment.patch)
download | inline diff:
diff --git a/src/backend/utils/adt/multirangetypes.c b/src/backend/utils/adt/multirangetypes.c
index 77732155647..51b0ec95ab4 100644
--- a/src/backend/utils/adt/multirangetypes.c
+++ b/src/backend/utils/adt/multirangetypes.c
@@ -713,7 +713,10 @@ multirange_get_range(TypeCacheEntry *rangetyp,
if (RANGE_HAS_LBOUND(flags))
ptr = (Pointer) att_addlength_pointer(ptr, typlen, ptr);
if (RANGE_HAS_UBOUND(flags))
+ {
+ ptr = (Pointer) att_align_pointer(ptr, typalign, typlen, ptr);
ptr = (Pointer) att_addlength_pointer(ptr, typlen, ptr);
+ }
len = (ptr - begin) + sizeof(RangeType) + sizeof(uint8);
range = palloc0(len);
diff --git a/src/test/regress/expected/multirangetypes.out b/src/test/regress/expected/multirangetypes.out
index f5f089741c1..bde3f248a75 100644
--- a/src/test/regress/expected/multirangetypes.out
+++ b/src/test/regress/expected/multirangetypes.out
@@ -97,6 +97,12 @@ select ' {( " a " " a ", " z " " z " ) }'::textmultirange;
{(" a a "," z z ")}
(1 row)
+select textrange('\\\\', repeat('a', 200))::textmultirange;
+ textrange
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ {["\\\\\\\\",aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)}
+(1 row)
+
select '{(,z)}'::textmultirange;
textmultirange
----------------
@@ -289,10 +295,10 @@ select textmultirange(textrange('a', 'c'), textrange('f', 'g'));
{[a,c),[f,g)}
(1 row)
-select textmultirange(textrange('a', 'c'), textrange('b', 'd'));
- textmultirange
-----------------
- {[a,d)}
+select textmultirange(textrange('\\\\', repeat('a', 200)), textrange('c', 'd'));
+ textmultirange
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ {["\\\\\\\\",aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa),[c,d)}
(1 row)
--
@@ -363,6 +369,13 @@ select unnest(textmultirange(textrange('a', 'b'), textrange('d', 'e')));
[d,e)
(2 rows)
+select unnest(textmultirange(textrange('\\\\', repeat('a', 200)), textrange('c', 'd')));
+ unnest
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ ["\\\\\\\\",aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)
+ [c,d)
+(2 rows)
+
--
-- create some test data and test the operators
--
diff --git a/src/test/regress/expected/rangetypes.out b/src/test/regress/expected/rangetypes.out
index e6ca99d43dc..2eaed6e1f4e 100644
--- a/src/test/regress/expected/rangetypes.out
+++ b/src/test/regress/expected/rangetypes.out
@@ -72,12 +72,6 @@ select ' ( " a " " a ", " z " " z " ) '::textrange;
(" a a "," z z ")
(1 row)
-select '(,z)'::textrange;
- textrange
------------
- (,z)
-(1 row)
-
select '(a,)'::textrange;
textrange
-----------
diff --git a/src/test/regress/sql/multirangetypes.sql b/src/test/regress/sql/multirangetypes.sql
index ad50afc0f55..df1edb4d31a 100644
--- a/src/test/regress/sql/multirangetypes.sql
+++ b/src/test/regress/sql/multirangetypes.sql
@@ -25,6 +25,7 @@ select '{}'::textmultirange;
select ' {} '::textmultirange;
select ' { empty, empty } '::textmultirange;
select ' {( " a " " a ", " z " " z " ) }'::textmultirange;
+select textrange('\\\\', repeat('a', 200))::textmultirange;
select '{(,z)}'::textmultirange;
select '{(a,)}'::textmultirange;
select '{[,z]}'::textmultirange;
@@ -63,7 +64,7 @@ select '{(a,a)}'::textmultirange;
select textmultirange();
select textmultirange(textrange('a', 'c'));
select textmultirange(textrange('a', 'c'), textrange('f', 'g'));
-select textmultirange(textrange('a', 'c'), textrange('b', 'd'));
+select textmultirange(textrange('\\\\', repeat('a', 200)), textrange('c', 'd'));
--
-- test casts, both a built-in range type and a user-defined one:
@@ -82,6 +83,7 @@ select textrange(null, null)::textmultirange;
--
select unnest(int4multirange(int4range('5', '6'), int4range('1', '2')));
select unnest(textmultirange(textrange('a', 'b'), textrange('d', 'e')));
+select unnest(textmultirange(textrange('\\\\', repeat('a', 200)), textrange('c', 'd')));
--
-- create some test data and test the operators
diff --git a/src/test/regress/sql/rangetypes.sql b/src/test/regress/sql/rangetypes.sql
index cb5353de6fb..a2d411d0daf 100644
--- a/src/test/regress/sql/rangetypes.sql
+++ b/src/test/regress/sql/rangetypes.sql
@@ -22,7 +22,6 @@ select '[z,a]'::textrange;
select ' empty '::textrange;
select ' ( empty, empty ) '::textrange;
select ' ( " a " " a ", " z " " z " ) '::textrange;
-select '(,z)'::textrange;
select '(a,)'::textrange;
select '[,z]'::textrange;
select '[a,]'::textrange;
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #17300: Server crashes on deserializing text multirange
2021-11-27 18:00 BUG #17300: Server crashes on deserializing text multirange PG Bug reporting form <noreply@postgresql.org>
2021-12-01 22:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Tom Lane <tgl@sss.pgh.pa.us>
2021-12-06 19:39 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
2021-12-11 01:48 ` Re: BUG #17300: Server crashes on deserializing text multirange Alexander Korotkov <aekorotkov@gmail.com>
@ 2021-12-13 14:28 ` Alexander Korotkov <aekorotkov@gmail.com>
0 siblings, 0 replies; 5+ messages in thread
From: Alexander Korotkov @ 2021-12-13 14:28 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Paul A Jungwirth <pj@illuminatedcomputing.com>; Alexander Law <exclusion@gmail.com>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Sat, Dec 11, 2021 at 4:48 AM Alexander Korotkov <aekorotkov@gmail.com> wrote:
> On Mon, Dec 6, 2021 at 10:39 PM Alexander Korotkov <aekorotkov@gmail.com> wrote:
> > On Thu, Dec 2, 2021 at 1:39 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > > PG Bug reporting form <noreply@postgresql.org> writes:
> > > > The following query:
> > >
> > > > select ('[\"\\\\\",\"\\\\' || repeat('a', 200) ||
> > > > '\"]')::textrange::textmultirange
> > >
> > > > leads to the server crash with the following stacktrace:
> > >
> > > I think the problem here is that the range bound values inside the
> > > multirange are supposed to be aligned (at least, write_multirange_data
> > > thinks so) but multirange_get_range isn't accounting for the alignment
> > > padding between the two values it extracts. In this example that
> > > causes it to extract an insane length for the second value.
> > >
> > > If so, this would indicate extremely slipshod testing of the multirange
> > > stuff, because the breakage is necessarily reached by multirange_out.
> >
> > Sorry for the delay. I'm going to fix this in the next couple of days.
>
> The proposed patch fixes the patch (and adds some minimal testing for
> it). I'm going to push it if no objections (backpatch to v14).
Pushed!
------
Regards,
Alexander Korotkov
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2021-12-13 14:28 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-11-27 18:00 BUG #17300: Server crashes on deserializing text multirange PG Bug reporting form <noreply@postgresql.org>
2021-12-01 22:39 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-12-06 19:39 ` Alexander Korotkov <aekorotkov@gmail.com>
2021-12-11 01:48 ` Alexander Korotkov <aekorotkov@gmail.com>
2021-12-13 14:28 ` Alexander Korotkov <aekorotkov@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox