From: Álvaro Herrera <alvherre@kurilemu.de>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Vadim Shakirov <vadimsakirov5@gmail.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH v1] Fix out-of-bounds access in pg_bsd_indent's parser stack
Date: Wed, 30 Sep 2026 13:59:25 +0200
Message-ID: <arz4He4Cy_zEm6ip@alvherre.pgsql> (raw)
In-Reply-To: <BB30A199-C1B6-4185-BD0B-A40BE5657A1C@yesql.se>
On 2026-Sep-30, Daniel Gustafsson wrote:
> I haven't read the patch, but reproducers of bugs are good to have. Is there a
> pattern which hits this out-of-bounds access?
Fun. I did this
(echo "int main() {" ; for i in `seq 1 256`; do echo "if ($i) "; done ; echo "switch (argc) {case 1: break;}}" ) > pgindent.c
which produced a smallish file:
$ ls -l pgindent.c
-rw-rw-r-- 1 alvherre alvherre 2497 Sep 30 13:52 pgindent.c
then ran pg_bsd_indent on it, which caused a segmentation fault and
ended with a somewhat larger file
$ ls -l pgindent.c
-rw-rw-r-- 1 alvherre alvherre 599314432 Sep 30 13:53 pgindent.c
That size was the entirety of the free disk space in that partition.
After applying this fix, it doesn't crash anymore, and merely dies with
a "Parser stack overflow" after having written up to "if (251)".
--
Álvaro Herrera PostgreSQL Developer — https://www.EnterpriseDB.com/
“Cuando no hay humildad las personas se degradan” (A. Christie)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: alvherre@kurilemu.de, daniel@yesql.se, vadimsakirov5@gmail.com, pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH v1] Fix out-of-bounds access in pg_bsd_indent's parser stack
In-Reply-To: <arz4He4Cy_zEm6ip@alvherre.pgsql>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox