From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Geoghegan <pg@bowt.ie>
cc: Matthias van de Meent <boekewurm+postgres@gmail.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
        Tomas Vondra <tomas.vondra@enterprisedb.com>,
        Jeff Davis <pgsql@j-davis.com>, benoit <benoit@hopsandfork.com>,
        Alexander Korotkov <aekorotkov@gmail.com>
Subject: Re: Optimizing nbtree ScalarArrayOp execution, allowing multi-column ordered scans, skip scan
In-reply-to: <CAH2-WzmjKdovfd-T+o0VaboZCdKnccXSvN4cub3qZw=baC_hyA@mail.gmail.com>
References: <CAH2-Wz=ksvN_sjcnD1+Bt-WtifRA5ok48aDYnq3pkKhxgMQpcw@mail.gmail.com> <CAEze2Wgdh5WZzOcUQxTUO45g4qL4oxfVOA8re0MqvKjsamrdFQ@mail.gmail.com> <CAH2-WzkExhbc5a7tuVy_pZFFiWZ4RiZTRfwVVM2+bcHUqor9ow@mail.gmail.com> <CAH2-WzkEyBU9UQM-5GWPcB=WEShAUKcJdvgFuqVHuPuO-iYW0Q@mail.gmail.com> <CAH2-Wz=X4wCT-x4HeM95CTqT147K_bL8mC_5d6TUzLPaHdE1nw@mail.gmail.com> <CAH2-Wz=_FQ0AVgoF+UT7EzafVyd7kanQ0-82BesrpjUHPtjLvg@mail.gmail.com> <CAH2-WzmjKdovfd-T+o0VaboZCdKnccXSvN4cub3qZw=baC_hyA@mail.gmail.com>
Comments: In-reply-to Peter Geoghegan <pg@bowt.ie>
	message dated "Fri, 20 Oct 2023 15:39:44 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3000246.1712537309.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sun, 07 Apr 2024 20:48:29 -0400
Message-ID: <3000247.1712537309@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/3000247.1712537309%40sss.pgh.pa.us>
Precedence: bulk

Coverity pointed out something that looks like a potentially live
problem in 5bf748b86:

/srv/coverity/git/pgsql-git/postgresql/src/backend/access/nbtree/nbtutils.=
c: 2950 in _bt_preprocess_keys()
2944                              * need to make sure that we don't throw =
away an array
2945                              * scan key.  _bt_compare_scankey_args ex=
pects us to
2946                              * always keep arrays (and discard non-ar=
rays).
2947                              */
2948                             Assert(j =3D=3D (BTEqualStrategyNumber - =
1));
2949                             Assert(xform[j].skey->sk_flags & SK_SEARC=
HARRAY);
>>>     CID 1596256:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "array".
2950                             Assert(xform[j].ikey =3D=3D array->scan_k=
ey);
2951                             Assert(!(cur->sk_flags & SK_SEARCHARRAY))=
;
2952                         }
2953                     }
2954                     else if (j =3D=3D (BTEqualStrategyNumber - 1))

Above this there is an assertion

                    Assert(!array || array->num_elems > 0);

which certainly makes it look like array->scan_key could be
a null-pointer dereference.

			regards, tom lane