pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Avoid crash in estimate_array_length with null root pointer. 2+ messages / 1 participants [nested] [flat]
* pgsql: Avoid crash in estimate_array_length with null root pointer. @ 2024-10-09 21:08 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 2+ messages in thread From: Tom Lane @ 2024-10-09 21:08 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Avoid crash in estimate_array_length with null root pointer. Commit 9391f7152 added a "PlannerInfo *root" parameter to estimate_array_length, but failed to consider the possibility that NULL would be passed for that, leading to a null pointer dereference. We could rectify the particular case shown in the bug report by fixing simplify_function/inline_function to pass through the root pointer. However, as long as eval_const_expressions is documented to accept NULL for root, similar hazards would remain. For now, let's just do the narrow fix of hardening estimate_array_length to not crash. Its behavior with NULL root will be the same as it was before 9391f7152, so this is not too awful. Per report from Fredrik Widlert (via Paul Ramsey). Back-patch to v17 where 9391f7152 came in. Discussion: https://postgr.es/m/518339E7-173E-45EC-A0FF-9A4A62AA4F40@cleverelephant.ca Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/5a4416192d220410779a4ef6d433e067ba7a7043 Modified Files -------------- src/backend/optimizer/path/costsize.c | 3 +++ src/backend/utils/adt/selfuncs.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Avoid crash in estimate_array_length with null root pointer. @ 2024-10-09 21:08 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 2+ messages in thread From: Tom Lane @ 2024-10-09 21:08 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Avoid crash in estimate_array_length with null root pointer. Commit 9391f7152 added a "PlannerInfo *root" parameter to estimate_array_length, but failed to consider the possibility that NULL would be passed for that, leading to a null pointer dereference. We could rectify the particular case shown in the bug report by fixing simplify_function/inline_function to pass through the root pointer. However, as long as eval_const_expressions is documented to accept NULL for root, similar hazards would remain. For now, let's just do the narrow fix of hardening estimate_array_length to not crash. Its behavior with NULL root will be the same as it was before 9391f7152, so this is not too awful. Per report from Fredrik Widlert (via Paul Ramsey). Back-patch to v17 where 9391f7152 came in. Discussion: https://postgr.es/m/518339E7-173E-45EC-A0FF-9A4A62AA4F40@cleverelephant.ca Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/a3c4a91f1e283cc4b79f0b0482d2c490a599d880 Modified Files -------------- src/backend/optimizer/path/costsize.c | 3 +++ src/backend/utils/adt/selfuncs.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2024-10-09 21:08 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-10-09 21:08 pgsql: Avoid crash in estimate_array_length with null root pointer. Tom Lane <tgl@sss.pgh.pa.us> 2024-10-09 21:08 pgsql: Avoid crash in estimate_array_length with null root pointer. Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox