Feedback-ID: ia2694551:Fastmail
Date: Fri, 29 Jul 2022 12:14:11 +0200
From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: kyzevan23@mail.ru, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17561: Server crashes on executing row() with very long
 argument list
Message-ID: <20220729101411.7b45rvhlrsgcajjo@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="5lkkrvvoycmlmxxx"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <17561-80350151b9ad2ad4@postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/20220729101411.7b45rvhlrsgcajjo%40alvherre.pgsql>
Precedence: bulk


--5lkkrvvoycmlmxxx
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

On 2022-Jul-29, PG Bug reporting form wrote:

> When executing the following query:
> (echo "SELECT row("; for ((i=1;i<100001;i++)); do echo "'$i',$i,"; done;
> echo "'0',0);"; ) | psql
> I got server crash with the following backtrace
...
> #5  0x0000557e1694f850 in ExceptionalCondition
> (conditionName=conditionName@entry=0x557e169b2e62 "attributeNumber >= 1",
> errorType=errorType@entry=0x557e169b0e7f "BadArgument",
> fileName=fileName@entry=0x557e169b2d7c "tupdesc.c", 
>     lineNumber=lineNumber@entry=598) at assert.c:69
> #6  0x0000557e1642790a in TupleDescInitEntry
> (desc=desc@entry=0x7f42a4c8b050,
> attributeNumber=attributeNumber@entry=-32768,
> attributeName=attributeName@entry=0x0, oidtypeid=23, typmod=typmod@entry=-1,
> attdim=attdim@entry=0)
>     at tupdesc.c:598
> #7  0x0000557e1664c509 in ExecTypeFromExprList (exprList=0x7f42a7830cf0) at
> execTuples.c:2009

Hah, of course.  I suppose we'd need something like this ... haven't
looked for other problem spots.

-- 
Álvaro Herrera               48°01'N 7°57'E  —  https://www.EnterpriseDB.com/

--5lkkrvvoycmlmxxx
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="overflow.patch"

diff --git a/src/backend/executor/execTuples.c b/src/backend/executor/execTuples.c
index 06ac253ea0..798a7e8518 100644
--- a/src/backend/executor/execTuples.c
+++ b/src/backend/executor/execTuples.c
@@ -2016,6 +2016,12 @@ ExecTypeFromExprList(List *exprList)
 									cur_resno,
 									exprCollation(e));
 		cur_resno++;
+
+		/* prevent overflow */
+		if (cur_resno >= MaxAttrNumber)
+			ereport(ERROR,
+					(errcode(ERRCODE_TOO_MANY_COLUMNS),
+					 errmsg("too many attributes")));
 	}
 
 	return typeInfo;

--5lkkrvvoycmlmxxx--