pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Masahiko Sawada <sawada.mshk@gmail.com>
Cc: krking@zju.edu.cn
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17477: A crash bug in transformValuesClause()
Date: Mon, 09 May 2022 13:42:02 -0400
Message-ID: <3824037.1652118122@sss.pgh.pa.us> (raw)
In-Reply-To: <6f7f0d34-0f58-41a9-98b5-bf86e1960165@postgresql.org>
References: <17477-0af3c6ac6b0a6ae0@postgresql.org>
	<CAD21AoCF5EWSXUR6MOGUWeqqo5bGw=_4LHDbwhPjO4x+xQn9QA@mail.gmail.com>
	<3809468.1652109938@sss.pgh.pa.us>
	<6f7f0d34-0f58-41a9-98b5-bf86e1960165@postgresql.org>

"Jonathan S. Katz" <jkatz@postgresql.org> writes:
> Confirmed reproducing the crash and that this fixes it. I did a short 
> double-take on the error message:
> 	ERROR:  subquery must return only one column
> but it is accurate, given this is what the subquery must do, and zero != 
> one.

Yeah, that's just an artifact of the strange test case.
A more straightforward usage might look like

create table nocols();
select * from nocols n, lateral (values(n.*)) v;

Anyway, this is not a security issue per our normal standards.
It is a crash due to SIGSEGV, but I don't see any likelihood
that it could be exploited for memory disclosure or arbitrary
code execution, so the effects are limited to momentary denial
of service.  There are lots of ways to produce DOS if you have
the ability to issue arbitrary SQL, so we generally don't
consider that a security issue unless there's the possibility
of doing more than just crashing one session.  Having said that,
a crash is unpleasant, so I'm going to take the small risk of
pushing this not-very-well-vetted patch into today's releases.

BTW, if this *had* been a security issue, we'd much rather you'd
have reported it to security@postgresql.org.  The bugs list is
an open channel.

			regards, tom lane





view thread (9+ messages)  latest in thread

Message-ID: <3824037.1652118122@sss.pgh.pa.us>
Permalink:  ../3824037.1652118122@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/3824037.1652118122@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, jkatz@postgresql.org, sawada.mshk@gmail.com, krking@zju.edu.cn, pgsql-bugs@lists.postgresql.org
  Subject: Re: BUG #17477: A crash bug in transformValuesClause()
  In-Reply-To: <3824037.1652118122@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox