From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pavel Stehule <pavel.stehule@gmail.com>
Cc: Richard Wesley <richard@duckdblabs.com>
Cc: PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Subject: Re: Query generates infinite loop
Date: Wed, 20 Apr 2022 13:03:45 -0400
Message-ID: <2842828.1650474225@sss.pgh.pa.us> (raw)
In-Reply-To: <CAFj8pRDzVzTfsnxs_T9T7k=HW_gWCryo==rVB-AX4R6pXo85xQ@mail.gmail.com>
References: <91B44E7B-68D5-448F-95C8-B4B3B0F5DEAF@duckdblabs.com>
<CAFj8pRDzVzTfsnxs_T9T7k=HW_gWCryo==rVB-AX4R6pXo85xQ@mail.gmail.com>
Pavel Stehule <pavel.stehule@gmail.com> writes:
> st 20. 4. 2022 v 18:42 odesÃlatel Richard Wesley <richard@duckdblabs.com>
> napsal:
>> select COUNT(*) FROM generate_series('-infinity'::TIMESTAMP, 'epoch'::TIMESTAMP, INTERVAL '1 DAY');
>>
>> This seems like a DoS great attack, so we are disallowing infinities as
>> bounds for both table and scalar series generation. As an upper bound, it
>> eventually gives an error, so it seems there is not much utility anyway.
> There are more ways to achieve the same effect. The protection is safe
> setting of temp_file_limit
Well, there are any number of ways to DOS a database you can issue
arbitrary queries to. For instance, cross joining a number of very
large tables. So I'm not excited about that aspect of it. Still,
it's true that infinities as generate_series endpoints are going
to work pretty oddly, so I agree with the idea of forbidding 'em.
Numeric has infinity as of late, so the numeric variant would
need to do this too.
I think we can allow infinity as the step, though.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pavel.stehule@gmail.com, richard@duckdblabs.com, pgsql-bugs@lists.postgresql.org
Subject: Re: Query generates infinite loop
In-Reply-To: <2842828.1650474225@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox