From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix jsonb_object_agg crash after eliminating null-valued pairs.
Date: Sat, 13 Dec 2025 21:18:42 +0000
Message-ID: <E1vUX0j-000ah2-1h@gemulon.postgresql.org> (raw)
Fix jsonb_object_agg crash after eliminating null-valued pairs.
In commit b61aa76e4 I added an assumption in jsonb_object_agg_finalfn
that it'd be okay to apply uniqueifyJsonbObject repeatedly to a
JsonbValue. I should have studied that code more closely first,
because in skip_nulls mode it removed leading nulls by changing the
"pairs" array start pointer. This broke the data structure's
invariants in two ways: pairs no longer references a repalloc-able
chunk, and the distance from pairs to the end of its array is less
than parseState->size. So any subsequent addition of more pairs is
at high risk of clobbering memory and/or causing repalloc to crash.
Unfortunately, adding more pairs is exactly what will happen when the
aggregate is being used as a window function.
Fix by rewriting uniqueifyJsonbObject to not do that. The prior
coding had little to recommend it anyway.
Reported-by: Alexander Lakhin <exclusion@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/ec5e96fb-ee49-4e5f-8a09-3f72b4780538@gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/ef5f559b95e2883c32d20d309d316f0572fd84b5
Modified Files
--------------
src/backend/utils/adt/jsonb.c | 7 ++++--
src/backend/utils/adt/jsonb_util.c | 49 +++++++++++++++----------------------
src/test/regress/expected/jsonb.out | 32 ++++++++++++++++++++++++
src/test/regress/sql/jsonb.sql | 6 +++++
4 files changed, 63 insertions(+), 31 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix jsonb_object_agg crash after eliminating null-valued pairs.
In-Reply-To: <E1vUX0j-000ah2-1h@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox