Feedback-ID: ie3de48e3:Fastmail
Date: Wed, 30 Sep 2026 13:59:25 +0200
From: =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@kurilemu.de>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Vadim Shakirov <vadimsakirov5@gmail.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH v1] Fix out-of-bounds access in pg_bsd_indent's parser
 stack
Message-ID: <arz4He4Cy_zEm6ip@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <BB30A199-C1B6-4185-BD0B-A40BE5657A1C@yesql.se>
Archived-At: 
 <https://www.postgresql.org/message-id/arz4He4Cy_zEm6ip%40alvherre.pgsql>
Precedence: bulk

On 2026-Sep-30, Daniel Gustafsson wrote:

> I haven't read the patch, but reproducers of bugs are good to have.  Is there a
> pattern which hits this out-of-bounds access?

Fun.  I did this

(echo "int main() {" ; for i in `seq 1 256`; do echo "if ($i) "; done ; echo "switch (argc) {case 1: break;}}" ) > pgindent.c

which produced a smallish file:
$ ls -l pgindent.c
-rw-rw-r-- 1 alvherre alvherre 2497 Sep 30 13:52 pgindent.c

then ran pg_bsd_indent on it, which caused a segmentation fault and
ended with a somewhat larger file

$ ls -l pgindent.c
-rw-rw-r-- 1 alvherre alvherre 599314432 Sep 30 13:53 pgindent.c

That size was the entirety of the free disk space in that partition.

After applying this fix, it doesn't crash anymore, and merely dies with
a "Parser stack overflow" after having written up to "if (251)".

-- 
Álvaro Herrera         PostgreSQL Developer  —  https://www.EnterpriseDB.com/
“Cuando no hay humildad las personas se degradan” (A. Christie)