Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\))
Subject: Re: Fix bug of COPY (on_error set_null)
From: Chao Li <li.evan.chao@gmail.com>
In-Reply-To: 
 <CACJufxHJikPdTV51qxWi5-rcva2-4Unhske80sESo+SQDyraDg@mail.gmail.com>
Date: Tue, 19 May 2026 06:22:15 +0800
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Peter Eisentraut <peter@eisentraut.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <D685C94B-9178-4077-A313-80F125FCE196@gmail.com>
References: <90EF4FA7-9FE2-4EDE-AC04-C349487F7C2A@gmail.com>
 <CACJufxHJikPdTV51qxWi5-rcva2-4Unhske80sESo+SQDyraDg@mail.gmail.com>
To: jian he <jian.universality@gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/D685C94B-9178-4077-A313-80F125FCE196%40gmail.com>
Precedence: bulk


> On May 16, 2026, at 13:17, jian he <jian.universality@gmail.com> =
wrote:
>=20
> On Fri, May 15, 2026 at 9:13=E2=80=AFAM Chao Li =
<li.evan.chao@gmail.com> wrote:
>>=20
>> Hi,
>>=20
>> I just tested =E2=80=9CAdd COPY (column list) (on_error set_null) =
option=E2=80=9D. While tracing a normal case, I found a mistake:
>>=20
>> In BeginCopyFrom(), cstate->domain_with_constraint is allocated using =
the length of the specified column list, and set using the index in that =
column list:
>> ```
>>                int                     attr_count =3D =
list_length(cstate->attnumlist);
>>=20
>>                /*
>>                 * When data type conversion fails and ON_ERROR is =
SET_NULL, we need
>>                 * ensure that the input column allow null values.  =
ExecConstraints()
>>                 * will cover most of the cases, but it does not =
verify domain
>>                 * constraints.  Therefore, for constrained domains, =
the null value
>>                 * check must be performed during the initial =
string-to-datum
>>                 * conversion (see CopyFromTextLikeOneRow()).
>>                 */
>>                cstate->domain_with_constraint =3D palloc0_array(bool, =
attr_count); <=3D=3D allocate with length of column list from SQL
>>=20
>>                foreach_int(attno, cstate->attnumlist)
>>                {
>>                        int                     i =3D =
foreach_current_index(attno);
>>=20
>>                        Form_pg_attribute att =3D =
TupleDescAttr(tupDesc, attno - 1);
>>=20
>>                        cstate->domain_with_constraint[i] =3D =
DomainHasConstraints(att->atttypid, NULL); <=3D set with index of column =
list from SQL
>>                }
>> ```
>>=20
>> However, cstate->domain_with_constraint is read in =
CopyFromTextLikeOneRow(), where it is accessed using the actual =
attribute number:
>> ```
>>        /* Loop to read the user attributes on the line. */
>>        foreach(cur, cstate->attnumlist)
>>        {
>>                int                     attnum =3D lfirst_int(cur);
>>                int                     m =3D attnum - 1;
>>=20
>>        ...
>>                                if (!cstate->domain_with_constraint[m] =
||
>> ```
>>=20
>> So, if the column list specified in SQL is shorter than the table=E2=80=
=99s actual attribute list, this may cause an out-of-bounds read.
>>=20
> Hi.
>=20
> This appears to be the same issue as reported here:
> =
https://postgr.es/m/CAHg+QDdej0c0gWJi2FnbirzhgzyZNPiTwC1P5B_-dSNCzq-91A@ma=
il.gmail.com

Thanks for pointing out that. I will review that patch.

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/