From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alexander Lakhin <exclusion@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17912: Invalid memory access when converting plpython' array containing empty array
Date: Sun, 30 Apr 2023 12:24:38 -0400
Message-ID: <2073074.1682871878@sss.pgh.pa.us> (raw)
In-Reply-To: <a8dfc214-5445-147e-2ebc-4de43ed56d38@gmail.com>
References: <17912-82ceed78731d9cdc@postgresql.org>
<1392974.1682694846@sss.pgh.pa.us>
<bf33fe9b-f2f8-5885-aae3-537cd4591386@gmail.com>
<1440309.1682705916@sss.pgh.pa.us>
<1483429.1682709429@sss.pgh.pa.us>
<5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com>
<1805878.1682788590@sss.pgh.pa.us>
<a8dfc214-5445-147e-2ebc-4de43ed56d38@gmail.com>
Alexander Lakhin <exclusion@gmail.com> writes:
> 29.04.2023 20:16, Tom Lane wrote:
>> I'm a little uncomfortable with changing the semantics of non-failing
>> cases in the back branches.
> I agree that we shouldn't introduce a new behavior in the released branches.
> For that moment I was thinking about the choice between v16 and v17
> for that patch to be committed to.
> But as you see the better solution now, the patch will be different and more
> extensive, I suppose, so I'd vote for postponing it for v17.
Here's a version that adopts plperl's logic, causing it to treat
empty sub-lists as being zero-length dimensions. Most of the new
test cases are borrowed from plperl, too, and most of them act
differently before and after the code change. So I'm pretty
hesitant to put this into stable branches. OTOH, maybe it's not
too late for v16?
I noticed one inarguable bug here, too: PLySequence_ToArray_recurse
leaks Python object refcounts after errors, because it has no
PG_TRY to ensure that Py_XDECREF() gets done. I'm not sure if
it's worth doing something about that in the back branches, given
the lack of complaints.
regards, tom lane
Attachments:tighten-multidim-array-shape-checks-2.patch (text/x-diff, 14.9K) downloaddiff --git a/src/pl/plpython/expected/plpython_types.out b/src/pl/plpython/expected/plpython_types.outindex c4e749a5a8..8a680e15c1 100644--- a/src/pl/plpython/expected/plpython_types.out+++ b/src/pl/plpython/expected/plpython_types.out@@ -687,23 +687,74 @@ SELECT * FROM test_type_conversion_array_mixed2();
ERROR: invalid input syntax for type integer: "abc"
CONTEXT: while creating return value
PL/Python function "test_type_conversion_array_mixed2"
-CREATE FUNCTION test_type_conversion_array_mixed3() RETURNS text[] AS $$-return [[], 'a']+-- check output of multi-dimensional arrays+CREATE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [['a'], ['b'], ['c']]
$$ LANGUAGE plpython3u;
-SELECT * FROM test_type_conversion_array_mixed3();- test_type_conversion_array_mixed3 +select test_type_conversion_md_array_out();+ test_type_conversion_md_array_out
-----------------------------------
- {[],a}+ {{a},{b},{c}}
(1 row)
+CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], []]+$$ LANGUAGE plpython3u;+select test_type_conversion_md_array_out();+ test_type_conversion_md_array_out +-----------------------------------+ {}+(1 row)++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], [1]]+$$ LANGUAGE plpython3u;+select test_type_conversion_md_array_out(); -- fail+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_md_array_out"+CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], 1]+$$ LANGUAGE plpython3u;+select test_type_conversion_md_array_out(); -- fail+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_md_array_out"+CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [1, []]+$$ LANGUAGE plpython3u;+select test_type_conversion_md_array_out(); -- fail+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_md_array_out"+CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[1], [[]]]+$$ LANGUAGE plpython3u;+select test_type_conversion_md_array_out(); -- fail+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_md_array_out"
CREATE FUNCTION test_type_conversion_mdarray_malformed() RETURNS int[] AS $$
return [[1,2,3],[4,5]]
$$ LANGUAGE plpython3u;
SELECT * FROM test_type_conversion_mdarray_malformed();
-ERROR: wrong length of inner sequence: has length 2, but 3 was expected-DETAIL: To construct a multidimensional array, the inner sequences must all have the same length.+ERROR: multidimensional arrays must have array expressions with matching dimensions
CONTEXT: while creating return value
PL/Python function "test_type_conversion_mdarray_malformed"
+CREATE FUNCTION test_type_conversion_mdarray_malformed2() RETURNS text[] AS $$+return [[1,2,3], "abc"]+$$ LANGUAGE plpython3u;+SELECT * FROM test_type_conversion_mdarray_malformed2();+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_mdarray_malformed2"+CREATE FUNCTION test_type_conversion_mdarray_malformed3() RETURNS text[] AS $$+return ["abc", [1,2,3]]+$$ LANGUAGE plpython3u;+SELECT * FROM test_type_conversion_mdarray_malformed3();+ERROR: multidimensional arrays must have array expressions with matching dimensions+CONTEXT: while creating return value+PL/Python function "test_type_conversion_mdarray_malformed3"
CREATE FUNCTION test_type_conversion_mdarray_toodeep() RETURNS int[] AS $$
return [[[[[[[1]]]]]]]
$$ LANGUAGE plpython3u;
diff --git a/src/pl/plpython/plpy_typeio.c b/src/pl/plpython/plpy_typeio.cindex 864b5f1765..0bfd3059f2 100644--- a/src/pl/plpython/plpy_typeio.c+++ b/src/pl/plpython/plpy_typeio.c@@ -54,9 +54,10 @@ static Datum PLyObject_ToTransform(PLyObToDatum *arg, PyObject *plrv,
bool *isnull, bool inarray);
static Datum PLySequence_ToArray(PLyObToDatum *arg, PyObject *plrv,
bool *isnull, bool inarray);
-static void PLySequence_ToArray_recurse(PLyObToDatum *elm, PyObject *list,- int *dims, int ndim, int dim,- Datum *elems, bool *nulls, int *currelem);+static void PLySequence_ToArray_recurse(PyObject *obj,+ ArrayBuildState **astatep,+ int *ndims, int *dims, int cur_depth,+ PLyObToDatum *elm, Oid elmbasetype);
/* conversion from Python objects to composite Datums */
static Datum PLyUnicode_ToComposite(PLyObToDatum *arg, PyObject *string, bool inarray);
@@ -1126,23 +1127,16 @@ PLyObject_ToTransform(PLyObToDatum *arg, PyObject *plrv,
/*
- * Convert Python sequence to SQL array.+ * Convert Python sequence (or list of lists) to SQL array.
*/
static Datum
PLySequence_ToArray(PLyObToDatum *arg, PyObject *plrv,
bool *isnull, bool inarray)
{
- ArrayType *array;- int i;- Datum *elems;- bool *nulls;- int len;- int ndim;+ ArrayBuildState *astate = NULL;+ int ndims = 1;
int dims[MAXDIM];
int lbs[MAXDIM];
- int currelem;- PyObject *pyptr = plrv;- PyObject *next;
if (plrv == Py_None)
{
@@ -1152,128 +1146,130 @@ PLySequence_ToArray(PLyObToDatum *arg, PyObject *plrv,
*isnull = false;
/*
- * Determine the number of dimensions, and their sizes.+ * For historical reasons, we allow any sequence (not only a list) at the+ * top level when converting a Python object to a SQL array. However, a+ * multi-dimensional array is recognized only when the object contains+ * true lists.
*/
- ndim = 0;-- Py_INCREF(plrv);-- for (;;)- {- if (!PyList_Check(pyptr))- break;-- if (ndim == MAXDIM)- ereport(ERROR,- (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),- errmsg("number of array dimensions exceeds the maximum allowed (%d)",- MAXDIM)));-- dims[ndim] = PySequence_Length(pyptr);- if (dims[ndim] < 0)- PLy_elog(ERROR, "could not determine sequence length for function return value");-- if (dims[ndim] == 0)- {- /* empty sequence */- break;- }-- ndim++;-- next = PySequence_GetItem(pyptr, 0);- Py_XDECREF(pyptr);- pyptr = next;- }- Py_XDECREF(pyptr);-- /*- * Check for zero dimensions. This happens if the object is a tuple or a- * string, rather than a list, or is not a sequence at all. We don't map- * tuples or strings to arrays in general, but in the first level, be- * lenient, for historical reasons. So if the object is a sequence of any- * kind, treat it as a one-dimensional array.- */- if (ndim == 0)- {- if (!PySequence_Check(plrv))- ereport(ERROR,- (errcode(ERRCODE_DATATYPE_MISMATCH),- errmsg("return value of function with array return type is not a Python sequence")));-- ndim = 1;- dims[0] = PySequence_Length(plrv);- }+ if (!PySequence_Check(plrv))+ ereport(ERROR,+ (errcode(ERRCODE_DATATYPE_MISMATCH),+ errmsg("return value of function with array return type is not a Python sequence")));- /* Allocate space for work arrays, after detecting array size overflow */- len = ArrayGetNItems(ndim, dims);- elems = palloc(sizeof(Datum) * len);- nulls = palloc(sizeof(bool) * len);+ /* Initialize dimensionality info with first-level dimension */+ memset(dims, 0, sizeof(dims));+ dims[0] = PySequence_Length(plrv);
/*
* Traverse the Python lists, in depth-first order, and collect all the
- * elements at the bottom level into 'elems'/'nulls' arrays.+ * elements at the bottom level into an ArrayBuildState.
*/
- currelem = 0;- PLySequence_ToArray_recurse(arg->u.array.elm, plrv,- dims, ndim, 0,- elems, nulls, &currelem);+ PLySequence_ToArray_recurse(plrv, &astate,+ &ndims, dims, 1,+ arg->u.array.elm,+ arg->u.array.elmbasetype);++ /* ensure we get zero-D array for no inputs, as per PG convention */+ if (astate == NULL)+ return PointerGetDatum(construct_empty_array(arg->u.array.elmbasetype));- for (i = 0; i < ndim; i++)+ for (int i = 0; i < ndims; i++)
lbs[i] = 1;
- array = construct_md_array(elems,- nulls,- ndim,- dims,- lbs,- arg->u.array.elmbasetype,- arg->u.array.elm->typlen,- arg->u.array.elm->typbyval,- arg->u.array.elm->typalign);-- return PointerGetDatum(array);+ return makeMdArrayResult(astate, ndims, dims, lbs,+ CurrentMemoryContext, true);
}
/*
* Helper function for PLySequence_ToArray. Traverse a Python list of lists in
- * depth-first order, storing the elements in 'elems'.+ * depth-first order, storing the elements in *astatep.+ *+ * The ArrayBuildState is created only when we first find a scalar element;+ * if we didn't do it like that, we'd need some other convention for knowing+ * whether we'd already found any scalars (and thus the number of dimensions+ * is frozen).
*/
static void
-PLySequence_ToArray_recurse(PLyObToDatum *elm, PyObject *list,- int *dims, int ndim, int dim,- Datum *elems, bool *nulls, int *currelem)+PLySequence_ToArray_recurse(PyObject *obj, ArrayBuildState **astatep,+ int *ndims, int *dims, int cur_depth,+ PLyObToDatum *elm, Oid elmbasetype)
{
int i;
+ int len = PySequence_Length(obj);- if (PySequence_Length(list) != dims[dim])- ereport(ERROR,- (errcode(ERRCODE_ARRAY_SUBSCRIPT_ERROR),- errmsg("wrong length of inner sequence: has length %d, but %d was expected",- (int) PySequence_Length(list), dims[dim]),- (errdetail("To construct a multidimensional array, the inner sequences must all have the same length."))));+ /* We should not get here with a non-sequence object */+ if (len < 0)+ PLy_elog(ERROR, "could not determine sequence length for function return value");- if (dim < ndim - 1)+ for (i = 0; i < len; i++)
{
- for (i = 0; i < dims[dim]; i++)- {- PyObject *sublist = PySequence_GetItem(list, i);+ /* fetch the array element */+ PyObject *subobj = PySequence_GetItem(obj, i);- PLySequence_ToArray_recurse(elm, sublist, dims, ndim, dim + 1,- elems, nulls, currelem);- Py_XDECREF(sublist);+ /* need PG_TRY to ensure we release the subobj's refcount */+ PG_TRY();+ {+ /* multi-dimensional array? */+ if (PyList_Check(subobj))+ {+ /* set size when at first element in this level, else compare */+ if (i == 0 && *ndims == cur_depth)+ {+ /* array after some scalars at same level? */+ if (*astatep != NULL)+ ereport(ERROR,+ (errcode(ERRCODE_INVALID_TEXT_REPRESENTATION),+ errmsg("multidimensional arrays must have array expressions with matching dimensions")));+ /* too many dimensions? */+ if (cur_depth + 1 > MAXDIM)+ ereport(ERROR,+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),+ errmsg("number of array dimensions exceeds the maximum allowed (%d)",+ MAXDIM)));+ /* OK, add a dimension */+ dims[*ndims] = PySequence_Length(subobj);+ (*ndims)++;+ }+ else if (cur_depth >= *ndims ||+ PySequence_Length(subobj) != dims[cur_depth])+ ereport(ERROR,+ (errcode(ERRCODE_INVALID_TEXT_REPRESENTATION),+ errmsg("multidimensional arrays must have array expressions with matching dimensions")));++ /* recurse to fetch elements of this sub-array */+ PLySequence_ToArray_recurse(subobj, astatep,+ ndims, dims, cur_depth + 1,+ elm, elmbasetype);+ }+ else+ {+ Datum dat;+ bool isnull;++ /* scalar after some sub-arrays at same level? */+ if (*ndims != cur_depth)+ ereport(ERROR,+ (errcode(ERRCODE_INVALID_TEXT_REPRESENTATION),+ errmsg("multidimensional arrays must have array expressions with matching dimensions")));++ /* convert non-list object to Datum */+ dat = elm->func(elm, subobj, &isnull, true);++ /* create ArrayBuildState if we didn't already */+ if (*astatep == NULL)+ *astatep = initArrayResult(elmbasetype,+ CurrentMemoryContext, true);++ /* ... and save the element value in it */+ (void) accumArrayResult(*astatep, dat, isnull,+ elmbasetype, CurrentMemoryContext);+ }
}
- }- else- {- for (i = 0; i < dims[dim]; i++)+ PG_FINALLY();
{
- PyObject *obj = PySequence_GetItem(list, i);-- elems[*currelem] = elm->func(elm, obj, &nulls[*currelem], true);- Py_XDECREF(obj);- (*currelem)++;+ Py_XDECREF(subobj);
}
+ PG_END_TRY();
}
}
diff --git a/src/pl/plpython/sql/plpython_types.sql b/src/pl/plpython/sql/plpython_types.sqlindex 9702a10a72..0985a9cca2 100644--- a/src/pl/plpython/sql/plpython_types.sql+++ b/src/pl/plpython/sql/plpython_types.sql@@ -328,11 +328,43 @@ $$ LANGUAGE plpython3u;
SELECT * FROM test_type_conversion_array_mixed2();
-CREATE FUNCTION test_type_conversion_array_mixed3() RETURNS text[] AS $$-return [[], 'a']++-- check output of multi-dimensional arrays+CREATE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [['a'], ['b'], ['c']]+$$ LANGUAGE plpython3u;++select test_type_conversion_md_array_out();++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], []]+$$ LANGUAGE plpython3u;++select test_type_conversion_md_array_out();++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], [1]]+$$ LANGUAGE plpython3u;++select test_type_conversion_md_array_out(); -- fail++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[], 1]+$$ LANGUAGE plpython3u;++select test_type_conversion_md_array_out(); -- fail++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [1, []]+$$ LANGUAGE plpython3u;++select test_type_conversion_md_array_out(); -- fail++CREATE OR REPLACE FUNCTION test_type_conversion_md_array_out() RETURNS text[] AS $$+return [[1], [[]]]
$$ LANGUAGE plpython3u;
-SELECT * FROM test_type_conversion_array_mixed3();+select test_type_conversion_md_array_out(); -- fail
CREATE FUNCTION test_type_conversion_mdarray_malformed() RETURNS int[] AS $$
@@ -341,6 +373,18 @@ $$ LANGUAGE plpython3u;
SELECT * FROM test_type_conversion_mdarray_malformed();
+CREATE FUNCTION test_type_conversion_mdarray_malformed2() RETURNS text[] AS $$+return [[1,2,3], "abc"]+$$ LANGUAGE plpython3u;++SELECT * FROM test_type_conversion_mdarray_malformed2();++CREATE FUNCTION test_type_conversion_mdarray_malformed3() RETURNS text[] AS $$+return ["abc", [1,2,3]]+$$ LANGUAGE plpython3u;++SELECT * FROM test_type_conversion_mdarray_malformed3();+
CREATE FUNCTION test_type_conversion_mdarray_toodeep() RETURNS int[] AS $$
return [[[[[[[1]]]]]]]
$$ LANGUAGE plpython3u;
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17912: Invalid memory access when converting plpython' array containing empty array
In-Reply-To: <2073074.1682871878@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox