pg.ddx.io  pgsql-committers@postgresql.org mailing list archive  
help / color / mirror / Atom feed
pgsql: Fix buggy interaction between array subscripts and subplan param
2+ messages / 1 participants
[nested] [flat]

* pgsql: Fix buggy interaction between array subscripts and subplan param
@ 2026-01-07 01:04 Andres Freund <andres@anarazel.de>
  0 siblings, 0 replies; 2+ messages in thread

From: Andres Freund @ 2026-01-07 01:04 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix buggy interaction between array subscripts and subplan params

In a7f107df2 I changed subplan param evaluation to happen within the
containing expression. As part of that, ExecInitSubPlanExpr() was changed to
evaluate parameters via a new EEOP_PARAM_SET expression step. These parameters
were temporarily stored into ExprState->resvalue/resnull, with some reasoning
why that would be fine. Unfortunately, that analysis was wrong -
ExecInitSubscriptionRef() evaluates the input array into "resv"/"resnull",
which will often point to ExprState->resvalue/resnull. This means that the
EEOP_PARAM_SET, if inside an array subscript, would overwrite the input array
to array subscript.

The fix is fairly simple - instead of evaluating into
ExprState->resvalue/resnull, store the temporary result of the subplan in the
subplan's return value.

Bug: #19370
Reported-by: Zepeng Zhang <redraiment@gmail.com>
Diagnosed-by: Tom Lane <tgl@sss.pgh.pa.us>
Diagnosed-by: Andres Freund <andres@anarazel.de>
Discussion: https://postgr.es/m/19370-7fb7a5854b7618f1@postgresql.org
Backpatch-through: 18

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/75609fded35e4d95a0e8b9875a46a496a03437cf

Modified Files
--------------
src/backend/executor/execExpr.c         | 18 ++++++++++--------
src/backend/executor/execExprInterp.c   |  6 +++---
src/test/regress/expected/subselect.out | 17 +++++++++++++++++
src/test/regress/sql/subselect.sql      | 11 +++++++++++
4 files changed, 41 insertions(+), 11 deletions(-)



^ permalink  raw  reply  [nested|flat] 2+ messages in thread

* pgsql: Fix buggy interaction between array subscripts and subplan param
@ 2026-01-07 01:04 Andres Freund <andres@anarazel.de>
  0 siblings, 0 replies; 2+ messages in thread

From: Andres Freund @ 2026-01-07 01:04 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix buggy interaction between array subscripts and subplan params

In a7f107df2 I changed subplan param evaluation to happen within the
containing expression. As part of that, ExecInitSubPlanExpr() was changed to
evaluate parameters via a new EEOP_PARAM_SET expression step. These parameters
were temporarily stored into ExprState->resvalue/resnull, with some reasoning
why that would be fine. Unfortunately, that analysis was wrong -
ExecInitSubscriptionRef() evaluates the input array into "resv"/"resnull",
which will often point to ExprState->resvalue/resnull. This means that the
EEOP_PARAM_SET, if inside an array subscript, would overwrite the input array
to array subscript.

The fix is fairly simple - instead of evaluating into
ExprState->resvalue/resnull, store the temporary result of the subplan in the
subplan's return value.

Bug: #19370
Reported-by: Zepeng Zhang <redraiment@gmail.com>
Diagnosed-by: Tom Lane <tgl@sss.pgh.pa.us>
Diagnosed-by: Andres Freund <andres@anarazel.de>
Discussion: https://postgr.es/m/19370-7fb7a5854b7618f1@postgresql.org
Backpatch-through: 18

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/bdc5dedfcaa57ddeef115252283019d79083d8a2

Modified Files
--------------
src/backend/executor/execExpr.c         | 18 ++++++++++--------
src/backend/executor/execExprInterp.c   |  6 +++---
src/test/regress/expected/subselect.out | 17 +++++++++++++++++
src/test/regress/sql/subselect.sql      | 11 +++++++++++
4 files changed, 41 insertions(+), 11 deletions(-)



^ permalink  raw  reply  [nested|flat] 2+ messages in thread


end of thread, other threads:[~2026-01-07 01:04 UTC | newest]

Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-01-07 01:04 pgsql: Fix buggy interaction between array subscripts and subplan param Andres Freund <andres@anarazel.de>
2026-01-07 01:04 pgsql: Fix buggy interaction between array subscripts and subplan param Andres Freund <andres@anarazel.de>

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox