From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: kyzevan23@mail.ru
To: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17561: Server crashes on executing row() with very long argument list
Date: Fri, 29 Jul 2022 12:14:11 +0200
Message-ID: <20220729101411.7b45rvhlrsgcajjo@alvherre.pgsql> (raw)
In-Reply-To: <17561-80350151b9ad2ad4@postgresql.org>
On 2022-Jul-29, PG Bug reporting form wrote:
> When executing the following query:
> (echo "SELECT row("; for ((i=1;i<100001;i++)); do echo "'$i',$i,"; done;
> echo "'0',0);"; ) | psql
> I got server crash with the following backtrace
...
> #5 0x0000557e1694f850 in ExceptionalCondition
> (conditionName=conditionName@entry=0x557e169b2e62 "attributeNumber >= 1",
> errorType=errorType@entry=0x557e169b0e7f "BadArgument",
> fileName=fileName@entry=0x557e169b2d7c "tupdesc.c",
> lineNumber=lineNumber@entry=598) at assert.c:69
> #6 0x0000557e1642790a in TupleDescInitEntry
> (desc=desc@entry=0x7f42a4c8b050,
> attributeNumber=attributeNumber@entry=-32768,
> attributeName=attributeName@entry=0x0, oidtypeid=23, typmod=typmod@entry=-1,
> attdim=attdim@entry=0)
> at tupdesc.c:598
> #7 0x0000557e1664c509 in ExecTypeFromExprList (exprList=0x7f42a7830cf0) at
> execTuples.c:2009
Hah, of course. I suppose we'd need something like this ... haven't
looked for other problem spots.
--
Álvaro Herrera 48°01'N 7°57'E — https://www.EnterpriseDB.com/Attachments:overflow.patch (text/x-diff, 513B) downloaddiff --git a/src/backend/executor/execTuples.c b/src/backend/executor/execTuples.cindex 06ac253ea0..798a7e8518 100644--- a/src/backend/executor/execTuples.c+++ b/src/backend/executor/execTuples.c@@ -2016,6 +2016,12 @@ ExecTypeFromExprList(List *exprList)
cur_resno,
exprCollation(e));
cur_resno++;
++ /* prevent overflow */+ if (cur_resno >= MaxAttrNumber)+ ereport(ERROR,+ (errcode(ERRCODE_TOO_MANY_COLUMNS),+ errmsg("too many attributes")));
}
return typeInfo;
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: alvherre@alvh.no-ip.org, kyzevan23@mail.ru, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17561: Server crashes on executing row() with very long argument list
In-Reply-To: <20220729101411.7b45rvhlrsgcajjo@alvherre.pgsql>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox