MIME-Version: 1.0
References: <202603201311.yhtqmvektawm@alvherre.pgsql>
 <bf49721a-a56f-4bdc-ac48-5d4dc1d01805@dunslane.net>
 <8ec9b67d-939e-4b22-8d56-a5129f92d32d@app.fastmail.com>
 <CAN4CZFNYM5jNA_gLu9miAXg_7c8Z2zf-ePc+0rzidAV3CBs=cw@mail.gmail.com>
 <555cdee4-c024-4872-9d96-82ef4216239c@dunslane.net>
 <SY7PR01MB10921A6E1E08A48F3426FE529B651A@SY7PR01MB10921.ausprd01.prod.outlook.com>
 <CAKFQuwYcppypeGBwa7ZbDAfoUXSv+kLhJuAXsdwBmKrvy8wDFw@mail.gmail.com>
 <a533fb1b-0f2c-4fc9-ab3b-6fb5ddac1800@dunslane.net>
 <a1c4dd3e-6694-4b7b-8432-f3b584735ff3@dunslane.net>
 <4efc426cde8eed9734af3a4552c3be29188f3661.camel@j-davis.com>
In-Reply-To: <4efc426cde8eed9734af3a4552c3be29188f3661.camel@j-davis.com>
From: SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>
Date: Mon, 13 Apr 2026 12:41:31 -0700
Message-ID: 
 <CAHg+QDdWtv9PKtPZEokwGCNtbv4MVnfYw5wMZrsEj4xizSNe5Q@mail.gmail.com>
Subject: Re: pg_get__*_ddl consolidation
To: Jeff Davis <pgsql@j-davis.com>
Cc: Andrew Dunstan <andrew@dunslane.net>,
 "David G. Johnston" <david.g.johnston@gmail.com>,
	Japin Li <japinli@hotmail.com>, Zsolt Parragi <zsolt.parragi@percona.com>,
	Euler Taveira <euler@eulerto.com>,
 =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@kurilemu.de>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: multipart/mixed; boundary="0000000000001b5b31064f5cac8c"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHg%2BQDdWtv9PKtPZEokwGCNtbv4MVnfYw5wMZrsEj4xizSNe5Q%40mail.gmail.com>
Precedence: bulk

--0000000000001b5b31064f5cac8c
Content-Type: multipart/alternative; boundary="0000000000001b5b30064f5cac8a"

--0000000000001b5b30064f5cac8a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Fri, Apr 10, 2026 at 1:03=E2=80=AFPM Jeff Davis <pgsql@j-davis.com> wrot=
e:

> On Sun, 2026-04-05 at 11:06 -0400, Andrew Dunstan wrote:
> > Pushed. I have moved the remaining get_*_ddl items to PG20-1
>
> The line:
>
>   role_settings =3D DatumGetArrayTypeP(datum);
>
> should be DatumGetArrayTypePCopy(), because it's being pfree()d later.
> The existing code will sometimes make a copy and sometimes not, e.g.:
>
>   -- settings are contrived to make the datum inline
>   CREATE USER u1;
>   ALTER ROLE u1 SET search_path =3D 'public, pg_catalog, pg_temp';
>   ALTER ROLE u1 SET work_mem=3D'64MB';
>   ALTER ROLE u1 SET statement_timeout=3D'30s';
>   ALTER ROLE u1 SET lock_timeout=3D'10s';
>   ALTER ROLE u1 SET idle_in_transaction_session_timeout =3D '60s';
>   SELECT pg_get_role_ddl('u1');
>   ERROR:  pfree called with invalid pointer 0x7986dd0c7cc8 (header
> 0x0000400600000000)
>

Yes, it appears to be a bug. Attached a patch to fix this. Tested with the
attached patch and don't see server crashing after that.

postgres=3D#   CREATE DATABASE crashtest TEMPLATE template0 LC_COLLATE 'C'
LC_CTYPE 'C';
  ALTER DATABASE crashtest SET search_path =3D 'public, pg_catalog';
  ALTER DATABASE crashtest SET work_mem =3D '64MB';
  ALTER DATABASE crashtest SET statement_timeout =3D '30s';
  ALTER DATABASE crashtest SET random_page_cost =3D 1.5;
  SELECT pg_get_database_ddl('crashtest');
CREATE DATABASE
ALTER DATABASE
ALTER DATABASE
ALTER DATABASE
ALTER DATABASE
                                            pg_get_database_ddl

---------------------------------------------------------------------------=
---------------------------------
 CREATE DATABASE crashtest WITH TEMPLATE =3D template0 ENCODING =3D 'UTF8'
LOCALE_PROVIDER =3D libc LOCALE =3D 'C';
 ALTER DATABASE crashtest OWNER TO azureuser;
 ALTER DATABASE crashtest SET search_path TO 'public, pg_catalog';
 ALTER DATABASE crashtest SET work_mem TO '64MB';
 ALTER DATABASE crashtest SET statement_timeout TO '30s';
 ALTER DATABASE crashtest SET random_page_cost TO '1.5';
(6 rows)

Thanks,
Satya

--0000000000001b5b30064f5cac8a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,</div><br><div class=3D"gmail_quote gm=
ail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Apr 10, =
2026 at 1:03=E2=80=AFPM Jeff Davis &lt;<a href=3D"mailto:pgsql@j-davis.com"=
>pgsql@j-davis.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote=
" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);=
padding-left:1ex">On Sun, 2026-04-05 at 11:06 -0400, Andrew Dunstan wrote:<=
br>
&gt; Pushed. I have moved the remaining get_*_ddl items to PG20-1<br>
<br>
The line:<br>
<br>
=C2=A0 role_settings =3D DatumGetArrayTypeP(datum);<br>
<br>
should be DatumGetArrayTypePCopy(), because it&#39;s being pfree()d later.<=
br>
The existing code will sometimes make a copy and sometimes not, e.g.:<br>
<br>
=C2=A0 -- settings are contrived to make the datum inline<br>
=C2=A0 CREATE USER u1;<br>
=C2=A0 ALTER ROLE u1 SET search_path =3D &#39;public, pg_catalog, pg_temp&#=
39;;<br>
=C2=A0 ALTER ROLE u1 SET work_mem=3D&#39;64MB&#39;;<br>
=C2=A0 ALTER ROLE u1 SET statement_timeout=3D&#39;30s&#39;;<br>
=C2=A0 ALTER ROLE u1 SET lock_timeout=3D&#39;10s&#39;;<br>
=C2=A0 ALTER ROLE u1 SET idle_in_transaction_session_timeout =3D &#39;60s&#=
39;;<br>
=C2=A0 SELECT pg_get_role_ddl(&#39;u1&#39;);<br>
=C2=A0 ERROR:=C2=A0 pfree called with invalid pointer 0x7986dd0c7cc8 (heade=
r<br>
0x0000400600000000)<br></blockquote><div><br></div><div>Yes, it appears to =
be a bug. Attached a patch to fix this. Tested with the=C2=A0</div><div>att=
ached patch and don&#39;t see server crashing after that.</div><div><br></d=
iv><div>postgres=3D# =C2=A0 CREATE DATABASE crashtest TEMPLATE template0 LC=
_COLLATE &#39;C&#39; LC_CTYPE &#39;C&#39;;<br>=C2=A0 ALTER DATABASE crashte=
st SET search_path =3D &#39;public, pg_catalog&#39;;<br>=C2=A0 ALTER DATABA=
SE crashtest SET work_mem =3D &#39;64MB&#39;;<br>=C2=A0 ALTER DATABASE cras=
htest SET statement_timeout =3D &#39;30s&#39;;<br>=C2=A0 ALTER DATABASE cra=
shtest SET random_page_cost =3D 1.5;<br>=C2=A0 SELECT pg_get_database_ddl(&=
#39;crashtest&#39;); <br>CREATE DATABASE<br>ALTER DATABASE<br>ALTER DATABAS=
E<br>ALTER DATABASE<br>ALTER DATABASE<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pg_get_database_ddl =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <=
br>------------------------------------------------------------------------=
------------------------------------<br>=C2=A0CREATE DATABASE crashtest WIT=
H TEMPLATE =3D template0 ENCODING =3D &#39;UTF8&#39; LOCALE_PROVIDER =3D li=
bc LOCALE =3D &#39;C&#39;;<br>=C2=A0ALTER DATABASE crashtest OWNER TO azure=
user;<br>=C2=A0ALTER DATABASE crashtest SET search_path TO &#39;public, pg_=
catalog&#39;;<br>=C2=A0ALTER DATABASE crashtest SET work_mem TO &#39;64MB&#=
39;;<br>=C2=A0ALTER DATABASE crashtest SET statement_timeout TO &#39;30s=
9;;<br>=C2=A0ALTER DATABASE crashtest SET random_page_cost TO &#39;1.5&#39;=
;<br>(6 rows)</div><div><br></div><div>Thanks,</div><div>Satya</div><div>=
=C2=A0</div></div></div>

--0000000000001b5b30064f5cac8a--

--0000000000001b5b31064f5cac8c
Content-Type: application/octet-stream;
	name="v1-0001-ddlutils-pfree-crash.patch"
Content-Disposition: attachment;
	filename="v1-0001-ddlutils-pfree-crash.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mnxllb110>
X-Attachment-Id: f_mnxllb110

ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC9kZGx1dGlscy5jIGIvc3JjL2JhY2tl
bmQvdXRpbHMvYWR0L2RkbHV0aWxzLmMKaW5kZXggYjE2YzI3N2QuLmM0ZjlmODZjIDEwMDY0NAot
LS0gYS9zcmMvYmFja2VuZC91dGlscy9hZHQvZGRsdXRpbHMuYworKysgYi9zcmMvYmFja2VuZC91
dGlscy9hZHQvZGRsdXRpbHMuYwpAQCAtNDgwLDcgKzQ4MCw3IEBAIHBnX2dldF9yb2xlX2RkbF9p
bnRlcm5hbChPaWQgcm9sZWlkLCBib29sIHByZXR0eSwgYm9vbCBtZW1iZXJzaGlwcykKIAkJaWYg
KGlzbnVsbCkKIAkJCWNvbnRpbnVlOwogCi0JCXJvbGVfc2V0dGluZ3MgPSBEYXR1bUdldEFycmF5
VHlwZVAoZGF0dW0pOworCQlyb2xlX3NldHRpbmdzID0gRGF0dW1HZXRBcnJheVR5cGVQQ29weShk
YXR1bSk7CiAKIAkJZGVjb25zdHJ1Y3RfYXJyYXlfYnVpbHRpbihyb2xlX3NldHRpbmdzLCBURVhU
T0lELCAmc2V0dGluZ3MsICZudWxscywgJm5zZXR0aW5ncyk7CiAKQEAgLTEwNjAsNyArMTA2MCw3
IEBAIHBnX2dldF9kYXRhYmFzZV9kZGxfaW50ZXJuYWwoT2lkIGRiaWQsIGJvb2wgcHJldHR5LAog
CQlpZiAoaXNudWxsKQogCQkJY29udGludWU7CiAKLQkJZGJjb25maWcgPSBEYXR1bUdldEFycmF5
VHlwZVAoZGF0dW0pOworCQlkYmNvbmZpZyA9IERhdHVtR2V0QXJyYXlUeXBlUENvcHkoZGF0dW0p
OwogCiAJCWRlY29uc3RydWN0X2FycmF5X2J1aWx0aW4oZGJjb25maWcsIFRFWFRPSUQsICZzZXR0
aW5ncywgJm51bGxzLCAmbnNldHRpbmdzKTsKIAo=
--0000000000001b5b31064f5cac8c--