MIME-Version: 1.0
References: <19384-65ff412feef17f06@postgresql.org>
In-Reply-To: <19384-65ff412feef17f06@postgresql.org>
From: Rahila Syed <rahilasyed90@gmail.com>
Date: Tue, 20 Jan 2026 16:45:31 +0530
Message-ID: <CAH2L28tTiH2wNq4tDLcHr2B2NG=kMunJmNfYj5L5tMhQukVnJA@mail.gmail.com>
Subject: Re: BUG #19384: Server crash at textout
To: dllggyx@outlook.com, pgsql-bugs@lists.postgresql.org
Content-Type: multipart/alternative; boundary="0000000000009025bc0648cfed3f"
Archived-At: <https://www.postgresql.org/message-id/CAH2L28tTiH2wNq4tDLcHr2B2NG%3DkMunJmNfYj5L5tMhQukVnJA%40mail.gmail.com>
Precedence: bulk

--0000000000009025bc0648cfed3f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Tue, Jan 20, 2026 at 2:29=E2=80=AFPM PG Bug reporting form <
noreply@postgresql.org> wrote:

> The following bug has been logged on the website:
>
> Bug reference:      19384
> Logged by:          Yuxiao Guo
> Email address:      dllggyx@outlook.com
> PostgreSQL version: 17.7
> Operating system:   Ubuntu 20.04 x86-64, docker image postgres:17.7
> Description:
>
> Hi, I found a crash in PostgreSQL. Here are the details:
>
> PoC:
> DROP TYPE IF EXISTS foo CASCADE;
> CREATE TYPE foo AS (a INT, b INT);
> BEGIN;
> DECLARE c CURSOR FOR SELECT (i, power(2, 30))::foo FROM
> generate_series(1,10) i;
> FETCH c;
> ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
> FETCH c;
>
>
> Stacktrace:
> #0 0x7ae1c818a00b (gsignal+0xcb)
> #1 0x7ae1c8169859 (abort+0x12b)
> #2 0x542fa7 (_ZN11__sanitizer5AbortEv+0x47)
> #3 0x5414d1 (_ZN11__sanitizer3DieEv+0xc1)
> #4 0x528a14 (_ZN6__asan19ScopedInErrorReportD2Ev+0x1c4)
> #5 0x52a5da (_ZN6__asan18ReportGenericErrorEmmmmbmjb+0x5ba)
> #6 0x523ef6 (__asan_memcpy+0x1d6)
> #7 0x17772d5 (textout+0x1b5)
> #8 0x1835834 (OutputFunctionCall+0x174)
> #9 0x167a568 (record_out+0x828)
> #10 0x1835834 (OutputFunctionCall+0x174)
> #11 0x595848 (printtup+0x958)
> #12 0x1336280 (RunFromStore+0x1d0)
> #13 0x1333ec0 (PortalRunSelect+0x150)
> #14 0x133321d (PortalRun+0x51d)
> #15 0x132f1de (exec_simple_query+0x146e)
> #16 0x1328627 (PostgresMain+0x2c57)
> #17 0x13192e4 (BackendMain+0xe4)
> #18 0x10a26c3 (postmaster_child_launch+0x193)
> #19 0x10adb91 (ServerLoop+0x4821)
> #20 0x10a76ec (PostmasterMain+0x241c)
> #21 0xd5c2b8 (main+0x458)
> #22 0x7ae1c816b083 (__libc_start_main+0xf3)
> #23 0x4a9c6e (_start+0x2e)
>
>
>
This problem is reproducible, also the issue seems to be linked to cursors
since the type cast with only SELECT statements runs fine.

CREATE TYPE foo AS (a INT, b INT);
ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;

postgres=3D# SELECT (i, power(2, 30))::foo FROM
generate_series(1,10) i;
       row
-----------------
 (1,1073741824)
 (2,1073741824)
 (3,1073741824)
 (4,1073741824)
 (5,1073741824)
 (6,1073741824)
 (7,1073741824)
 (8,1073741824)
 (9,1073741824)
 (10,1073741824)
(10 rows)

Also, it happens only  if ALTER TYPE to TEXT is run after DECLARING the
cursor.

Another observation is that when I lower the exponent to 10, the crash no
longer occurs,
but the output is different.

CREATE TYPE foo AS (a INT, b INT);
BEGIN;
DECLARE c CURSOR FOR SELECT (i, power(2, 10))::foo FROM
generate_series(1,10) i;
DECLARE CURSOR
FETCH c;
   row
----------
 (1,1024)
(1 row)

ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
FETCH c;
   row
----------
 (2,\x10)
(1 row)

Thank you,
Rahila Syed

--0000000000009025bc0648cfed3f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,</div><br><div class=3D"gmail_quote gm=
ail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jan 20, =
2026 at 2:29=E2=80=AFPM PG Bug reporting form &lt;<a href=3D"mailto:noreply=
@postgresql.org">noreply@postgresql.org</a>&gt; wrote:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">The following bug has been logged on=
 the website:<br>
<br>
Bug reference:=C2=A0 =C2=A0 =C2=A0 19384<br>
Logged by:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Yuxiao Guo<br>
Email address:=C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:dllggyx@outlook.com" t=
arget=3D"_blank">dllggyx@outlook.com</a><br>
PostgreSQL version: 17.7<br>
Operating system:=C2=A0 =C2=A0Ubuntu 20.04 x86-64, docker image postgres:17=
.7<br>
Description:=C2=A0 =C2=A0 =C2=A0 =C2=A0 <br>
<br>
Hi, I found a crash in PostgreSQL. Here are the details:<br>
<br>
PoC:<br>
DROP TYPE IF EXISTS foo CASCADE;<br>
CREATE TYPE foo AS (a INT, b INT);<br>
BEGIN;<br>
DECLARE c CURSOR FOR SELECT (i, power(2, 30))::foo FROM<br>
generate_series(1,10) i;<br>
FETCH c;<br>
ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>
FETCH c;<br>
<br>
<br>
Stacktrace:<br>
#0 0x7ae1c818a00b (gsignal+0xcb)<br>
#1 0x7ae1c8169859 (abort+0x12b)<br>
#2 0x542fa7 (_ZN11__sanitizer5AbortEv+0x47)<br>
#3 0x5414d1 (_ZN11__sanitizer3DieEv+0xc1)<br>
#4 0x528a14 (_ZN6__asan19ScopedInErrorReportD2Ev+0x1c4)<br>
#5 0x52a5da (_ZN6__asan18ReportGenericErrorEmmmmbmjb+0x5ba)<br>
#6 0x523ef6 (__asan_memcpy+0x1d6)<br>
#7 0x17772d5 (textout+0x1b5)<br>
#8 0x1835834 (OutputFunctionCall+0x174)<br>
#9 0x167a568 (record_out+0x828)<br>
#10 0x1835834 (OutputFunctionCall+0x174)<br>
#11 0x595848 (printtup+0x958)<br>
#12 0x1336280 (RunFromStore+0x1d0)<br>
#13 0x1333ec0 (PortalRunSelect+0x150)<br>
#14 0x133321d (PortalRun+0x51d)<br>
#15 0x132f1de (exec_simple_query+0x146e)<br>
#16 0x1328627 (PostgresMain+0x2c57)<br>
#17 0x13192e4 (BackendMain+0xe4)<br>
#18 0x10a26c3 (postmaster_child_launch+0x193)<br>
#19 0x10adb91 (ServerLoop+0x4821)<br>
#20 0x10a76ec (PostmasterMain+0x241c)<br>
#21 0xd5c2b8 (main+0x458)<br>
#22 0x7ae1c816b083 (__libc_start_main+0xf3)<br>
#23 0x4a9c6e (_start+0x2e)<br>
<br>
<br></blockquote><div><br></div><div>This problem is reproducible, also the=
 issue seems to be linked to cursors<br>since the type cast with only SELEC=
T statements runs fine.<br><br>CREATE TYPE foo AS (a INT, b INT);<br>ALTER =
TYPE foo ALTER ATTRIBUTE b TYPE TEXT;</div><div><br>postgres=3D# SELECT (i,=
 power(2, 30))::foo FROM<br>generate_series(1,10) i;<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0row<br>-----------------<br>=C2=A0(1,1073741824)<br>=C2=A0(2,1073=
741824)<br>=C2=A0(3,1073741824)<br>=C2=A0(4,1073741824)<br>=C2=A0(5,1073741=
824)<br>=C2=A0(6,1073741824)<br>=C2=A0(7,1073741824)<br>=C2=A0(8,1073741824=
)<br>=C2=A0(9,1073741824)<br>=C2=A0(10,1073741824)<br>(10 rows)<br><br>Also=
, it happens only=C2=A0 if ALTER TYPE to TEXT is run after DECLARING the cu=
rsor.</div><div><br>Another observation is that when I lower the exponent t=
o 10, the crash no longer occurs, <br>but the output is different.<br><br>C=
REATE TYPE foo AS (a INT, b INT);</div><div>BEGIN;<br>DECLARE c CURSOR FOR =
SELECT (i, power(2, 10))::foo FROM<br>generate_series(1,10) i;<br>DECLARE C=
URSOR<br>FETCH c;<br>=C2=A0 =C2=A0row<br>----------<br>=C2=A0(1,1024)<br>(1=
 row)<br><br>ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>FETCH c;<br>=C2=
=A0 =C2=A0row<br>----------<br>=C2=A0(2,\x10)<br>(1 row)</div><div><br>Than=
k you,</div><div>Rahila Syed</div><div><br></div></div></div>

--0000000000009025bc0648cfed3f--