Subject: BUG #19504: Segmentation fault in plpython3u function (pg19)

From: PG Bug reporting form <[email-masked]>
Date: Tue, 02 Jun 2026 08:58:26 +0000

The following bug has been logged on the website:

Bug reference:      19504
Logged by:          RekGRpth
Email address:      [email-masked]
PostgreSQL version: 18.4
Operating system:   docker alpine 3.23
Description:        

```sql
CREATE LANGUAGE plpython3u;

CREATE OR REPLACE FUNCTION f() RETURNS text AS $$
    import ctypes
    postgres = ctypes.CDLL(None)
    pchomp = postgres['pchomp']
#    pchomp.restype = ctypes.c_char_p
    return ctypes.cast(pchomp("error\n"), ctypes.c_char_p).value
$$ LANGUAGE plpython3u;

SELECT f();
server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.
```
```
#0  0x00007a0662f4a104 in strlen (s=<optimized out>) at
src/string/strlen.c:17
#1  0x00007a063a5e6947 in ?? () from
/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-musl.so
#2  0x00007a063a92a7a3 in _PyObject_GenericGetAttrWithDict () from
/usr/lib/libpython3.12.so.1.0
#3  0x00007a063a929c7f in PyObject_GetAttr () from
/usr/lib/libpython3.12.so.1.0
#4  0x00007a063a9d44ff in _PyEval_EvalFrameDefault () from
/usr/lib/libpython3.12.so.1.0
#5  0x00007a063a9db321 in PyEval_EvalCode () from
/usr/lib/libpython3.12.so.1.0
#6  0x00007a063af9d0fb in PLy_procedure_call (proc=0x7a063a68bd90,
kargs=0x7a063afa9912 "args", vargs=0x7a063af38a40) at plpy_exec.c:1111
#7  0x00007a063af99990 in PLy_exec_function (fcinfo=0x7a063a6213a8,
proc=0x7a063a68bd90) at plpy_exec.c:103
#8  0x00007a063af9db69 in plpython3_call_handler (fcinfo=0x7a063a6213a8) at
plpy_main.c:202
#9  0x000058e1b6a2260b in ExecEvalFuncExprFusage (state=0x7a063a621250,
op=0x7a063a621970, econtext=0x7a063a620ef8) at execExprInterp.c:3002
#10 0x000058e1b6a1e7d4 in ExecInterpExpr (state=0x7a063a621250,
econtext=0x7a063a620ef8, isnull=0x0) at execExprInterp.c:1014
#11 0x000058e1b6a21188 in ExecInterpExprStillValid (state=0x7a063a621250,
econtext=0x7a063a620ef8, isNull=0x0) at execExprInterp.c:2301
#12 0x000058e1b6a894e6 in ExecEvalExprNoReturn (state=0x7a063a621250,
econtext=0x7a063a620ef8) at ../../../src/include/executor/executor.h:426
#13 0x000058e1b6a895a4 in ExecEvalExprNoReturnSwitchContext
(state=0x7a063a621250, econtext=0x7a063a620ef8) at
../../../src/include/executor/executor.h:467
#14 0x000058e1b6a89605 in ExecProject (projInfo=0x7a063a621248) at
../../../src/include/executor/executor.h:499
#15 0x000058e1b6a89824 in ExecResult (pstate=0x7a063a620de8) at
nodeResult.c:135
#16 0x000058e1b6a3c4ff in ExecProcNodeInstr (node=0x7a063a620de8) at
execProcnode.c:486
#17 0x000058e1b6a3c4d0 in ExecProcNodeFirst (node=0x7a063a620de8) at
execProcnode.c:470
#18 0x000058e1b6a2da3b in ExecProcNode (node=0x7a063a620de8) at
../../../src/include/executor/executor.h:320
#19 0x000058e1b6a30aa5 in ExecutePlan (queryDesc=0x7a0662536bb0,
operation=CMD_SELECT, sendTuples=true, numberTuples=0,
direction=ForwardScanDirection, dest=0x7a063a623e58) at execMain.c:1727
#20 0x000058e1b6a2e0ed in standard_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at execMain.c:368
#21 0x00007a0662035bf1 in explain_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at auto_explain.c:387
#22 0x00007a0662024034 in pgss_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at pg_stat_statements.c:1034
#23 0x00007a0662012346 in pgsk_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at pg_stat_kcache.c:1093
#24 0x00007a06620041d5 in pgqs_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at pg_qualstats.c:677
#25 0x00007a0661ff1d1f in pgws_ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at pg_wait_sampling.c:1052
#26 0x000058e1b6a2df38 in ExecutorRun (queryDesc=0x7a0662536bb0,
direction=ForwardScanDirection, count=0) at execMain.c:303
#27 0x000058e1b6d6e3de in PortalRunSelect (portal=0x7a063b2a2d50,
forward=true, count=0, dest=0x7a063a623e58) at pquery.c:916
#28 0x000058e1b6d6e017 in PortalRun (portal=0x7a063b2a2d50,
count=9223372036854775807, isTopLevel=true, dest=0x7a063a623e58,
altdest=0x7a063a623e58, qc=0x7fffc568e7f0) at pquery.c:760
#29 0x000058e1b6d664af in exec_simple_query (query_string=0x7a06624ef4a0
"SELECT f();") at postgres.c:1288
#30 0x000058e1b6d6bfcf in PostgresMain (dbname=0x7a0661ec0b90 "postgres",
username=0x7a0662acf020 "postgres") at postgres.c:4840
#31 0x000058e1b6d616ee in BackendMain (startup_data=0x7fffc568eaa0,
startup_data_len=24) at backend_startup.c:124
#32 0x000058e1b6c4d9ad in postmaster_child_launch (child_type=B_BACKEND,
child_slot=1, startup_data=0x7fffc568eaa0, startup_data_len=24,
client_sock=0x7fffc568eb00) at launch_backend.c:268
#33 0x000058e1b6c54711 in BackendStartup (client_sock=0x7fffc568eb00) at
postmaster.c:3630
#34 0x000058e1b6c51b3d in ServerLoop () at postmaster.c:1722
#35 0x000058e1b6c5142c in PostmasterMain (argc=1, argv=0x7a0662d34a00) at
postmaster.c:1412
#36 0x000058e1b6ad0b51 in main (argc=1, argv=0x7a0662d34a00) at main.c:231
```

---

From: Tom Lane <[email-masked]>
Date: Tue, 02 Jun 2026 15:26:12 -0400

>     return ctypes.cast(pchomp("error\n"), ctypes.c_char_p).value

This is not a Postgres bug, it's an incorrect plpython function.
Type text is not equivalent to "char *".

			regards, tom lane