pg.ddx.io pgsql-hackers@postgresql.org mailing list archive
help / color / mirror / Atom feedcrash in pg_identify_object_as_address
4+ messages / 3 participants
[nested] [flat]
Commits from this thread:
2019-02-20 e4542ca961 545928bbbf ddad002dea 728ac262d1 5721b9b3ce Make object address handling more robust
* crash in pg_identify_object_as_address
@ 2019-02-18 20:27 Alvaro Herrera <alvherre@2ndquadrant.com>
0 siblings, 1 reply; 4+ messages in thread
From: Alvaro Herrera @ 2019-02-18 20:27 UTC (permalink / raw)
To: Pg Hackers <pgsql-hackers@lists.postgresql.org>
Hello
I just came across a crash while debugging some corrupted system
catalogs; pg_identify_object_as_address fails to cope with some NULL
input, causing a crash. Attached patch fixes it. Naturally, the output
array will contain NULL members in the output, but that's better than
crashing ...
(The first hunk is purely speculative; I haven't seen anything that
requires that. The actual fix is in the other hunks. But seems better
to be defensive.)
The crash can be reproduced thusly
create function f() returns int language plpgsql as $$ begin return 1; end; $$;
update pg_proc set pronamespace = 9999 where proname = 'f' returning oid \gset
select * from pg_identify_object_as_address('pg_proc'::regclass, :oid, 0);
After the patch, the last line returns:
type | object_names | object_args
----------+--------------+-------------
function | {NULL,f} | {}
where the NULL obviously corresponds to the bogus pg_namespace OID being
referenced.
The patch is on 9.6. I checked 10 and it applies fine there. My
intention is to apply to all branches since 9.5.
--
Álvaro Herrera PostgreSQL Expert, https://www.2ndQuadrant.com/
Attachments:
pg_identify_object_as_address-crash.patch (text/x-diff, 1.5K) download
diff --git a/src/backend/catalog/objectaddress.c b/src/backend/catalog/objectaddress.c
index bd55dfd08e3..479087592da 100644
--- a/src/backend/catalog/objectaddress.c
+++ b/src/backend/catalog/objectaddress.c
@@ -3576,7 +3576,10 @@ pg_identify_object_as_address(PG_FUNCTION_ARGS)
pfree(identity);
/* object_names */
- values[1] = PointerGetDatum(strlist_to_textarray(names));
+ if (names != NIL)
+ values[1] = PointerGetDatum(strlist_to_textarray(names));
+ else
+ values[1] = PointerGetDatum(construct_empty_array(TEXTOID));
nulls[1] = false;
/* object_args */
@@ -4803,10 +4806,12 @@ strlist_to_textarray(List *list)
{
ArrayType *arr;
Datum *datums;
+ bool *nulls;
int j = 0;
ListCell *cell;
MemoryContext memcxt;
MemoryContext oldcxt;
+ int one = 1;
memcxt = AllocSetContextCreate(CurrentMemoryContext,
"strlist to array",
@@ -4814,17 +4819,24 @@ strlist_to_textarray(List *list)
oldcxt = MemoryContextSwitchTo(memcxt);
datums = palloc(sizeof(text *) * list_length(list));
+ nulls = palloc(sizeof(bool) * list_length(list));
foreach(cell, list)
{
char *name = lfirst(cell);
- datums[j++] = CStringGetTextDatum(name);
+ if (name)
+ {
+ nulls[j] = false;
+ datums[j++] = CStringGetTextDatum(name);
+ }
+ else
+ nulls[j++] = true;
}
MemoryContextSwitchTo(oldcxt);
- arr = construct_array(datums, list_length(list),
- TEXTOID, -1, false, 'i');
+ arr = construct_md_array(datums, nulls, 1, &j,
+ &one, TEXTOID, -1, false, 'i');
MemoryContextDelete(memcxt);
return arr;
* Re: crash in pg_identify_object_as_address
@ 2019-02-18 22:13 Tom Lane <tgl@sss.pgh.pa.us>
parent: Alvaro Herrera <alvherre@2ndquadrant.com>
0 siblings, 1 reply; 4+ messages in thread
From: Tom Lane @ 2019-02-18 22:13 UTC (permalink / raw)
To: Alvaro Herrera <alvherre@2ndquadrant.com>; +Cc: Pg Hackers <pgsql-hackers@lists.postgresql.org>
Alvaro Herrera <alvherre@2ndquadrant.com> writes:
> I just came across a crash while debugging some corrupted system
> catalogs; pg_identify_object_as_address fails to cope with some NULL
> input, causing a crash. Attached patch fixes it. Naturally, the output
> array will contain NULL members in the output, but that's better than
> crashing ...
Hm, does this overlap with Paquier's much-delayed patch in
https://commitfest.postgresql.org/22/1947/
?
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: crash in pg_identify_object_as_address
@ 2019-02-19 02:21 Michael Paquier <michael@paquier.xyz>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: Michael Paquier @ 2019-02-19 02:21 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Alvaro Herrera <alvherre@2ndquadrant.com>; Pg Hackers <pgsql-hackers@lists.postgresql.org>
On Mon, Feb 18, 2019 at 05:13:27PM -0500, Tom Lane wrote:
> Hm, does this overlap with Paquier's much-delayed patch in
> https://commitfest.postgresql.org/22/1947/
It partially overlaps, still my patch set would crash as well in that
case. Treating object_names the same way as object_args sounds good
to me, as well as making strlist_to_textarray smarter to treat NULL
inputs.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: crash in pg_identify_object_as_address
@ 2019-02-20 14:27 Alvaro Herrera <alvherre@2ndquadrant.com>
parent: Michael Paquier <michael@paquier.xyz>
0 siblings, 0 replies; 4+ messages in thread
From: Alvaro Herrera @ 2019-02-20 14:27 UTC (permalink / raw)
To: Michael Paquier <michael@paquier.xyz>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Pg Hackers <pgsql-hackers@lists.postgresql.org>
Pushed, thanks.
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2019-02-20 14:27 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-02-18 20:27 crash in pg_identify_object_as_address Alvaro Herrera <alvherre@2ndquadrant.com>
2019-02-18 22:13 ` Tom Lane <tgl@sss.pgh.pa.us>
2019-02-19 02:21 ` Michael Paquier <michael@paquier.xyz>
2019-02-20 14:27 ` Alvaro Herrera <alvherre@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox