Content-Type: multipart/mixed; boundary="------------rvXMAhf18VxUy9Ukx82eXrSy"
Message-ID: <c6fff161-9aee-4290-9ada-71e21e4d84de@gmail.com>
Date: Tue, 3 Mar 2026 18:33:40 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: pgsql-hackers@lists.postgresql.org
From: Florin Irion <irionr@gmail.com>
Subject: UBSAN crash in EventTriggerCollectAlterTSConfig (memcpy with NULL
 src)
Cc: =?UTF-8?Q?=C3=81lvaro_Herrera?= <alvherre@kurilemu.de>
Archived-At: 
 <https://www.postgresql.org/message-id/c6fff161-9aee-4290-9ada-71e21e4d84de%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------rvXMAhf18VxUy9Ukx82eXrSy
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi,

While working on the pg_get_domain_ddl() patch [1], I installed an
event trigger on ddl_command_end in test_setup.sql to automatically
round-trip DDL.  This triggered a UBSAN crash on CI [2] that turns out
to be a pre-existing bug since b488c580aef(?).


The DROP MAPPING code path in tsearchcmds.c unconditionally calls:

```
EventTriggerCollectAlterTSConfig(stmt, cfgId, NULL, 0);
```

Inside EventTriggerCollectAlterTSConfig(), this reaches:

```
command->d.atscfg.dictIds = palloc_array(Oid, ndicts);   /* ndicts=0 */
memcpy(command->d.atscfg.dictIds, dictIds, sizeof(Oid) * ndicts);
                                    ^^^^^^^ NULL
```

Under -fsanitize=undefined this triggers SIGABRT and crashes the server.

The bug has been latent for 11 years because without an active event
trigger, currentEventTriggerState is NULL and the function returns early
at the top, never reaching the memcpy.  The standard regression suite
never had an event trigger installed during the tsdicts test — until now.

Reproducer (crashes only under UBSAN) and patch attached:


This affects all branches back to 9.5 where b488c580aef landed.

[1] https://www.postgresql.org/message-id/CAPgqM1V4LW2qiDLPsusb7s0kYbSDJjH5Tt%2B-ZzVmPU7xV0TJNQ%40mail.gmail.com
[2] https://cirrus-ci.com/task/6170470552174592

--

Cheers,
Florin

EDB -- www.enterprisedb.com

--------------rvXMAhf18VxUy9Ukx82eXrSy
Content-Type: text/plain; charset=UTF-8;
 name="v1-0001-Add-regression-test-for-EventTriggerCollectAlterT.patch"
Content-Disposition: attachment;
 filename*0="v1-0001-Add-regression-test-for-EventTriggerCollectAlterT.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSBiYzM4ZjcwMTZjODY4ZmYxYmU2ODIxNGI0YTEzNDc3M2NkYTIxNGNiIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBGbG9yaW4gSXJpb24gPGZsb3Jpbi5pcmlvbkBlbnRl
cnByaXNlZGIuY29tPgpEYXRlOiBUdWUsIDMgTWFyIDIwMjYgMTc6NDE6MjMgKzAxMDAKU3Vi
amVjdDogW1BBVENIIHYxIDEvMl0gQWRkIHJlZ3Jlc3Npb24gdGVzdCBmb3IKIEV2ZW50VHJp
Z2dlckNvbGxlY3RBbHRlclRTQ29uZmlnIHdpdGggTlVMTCBkaWN0SWRzCgpUaGUgRFJPUCBN
QVBQSU5HIGNvZGUgcGF0aCBpbiB0c2VhcmNoY21kcy5jIGNhbGxzCkV2ZW50VHJpZ2dlckNv
bGxlY3RBbHRlclRTQ29uZmlnKHN0bXQsIGNmZ0lkLCBOVUxMLCAwKS4gIFdoZW4gYW4gZXZl
bnQKdHJpZ2dlciBvbiBkZGxfY29tbWFuZF9lbmQgaXMgYWN0aXZlLCB0aGlzIHJlYWNoZXMg
bWVtY3B5KGRlc3QsIE5VTEwsIDApCndoaWNoIGlzIHVuZGVmaW5lZCBiZWhhdmlvci4gIFVu
ZGVyIC1mc2FuaXRpemU9dW5kZWZpbmVkIHRoaXMgY3Jhc2hlcwp0aGUgc2VydmVyLgoKQWRk
IGEgdGVzdCB0aGF0IGV4ZXJjaXNlcyB0aGlzIGV4YWN0IGNvZGUgcGF0aDogYSBkZGxfY29t
bWFuZF9lbmQgZXZlbnQKdHJpZ2dlciBjb21iaW5lZCB3aXRoIEFMVEVSIFRFWFQgU0VBUkNI
IENPTkZJR1VSQVRJT04gLi4uIERST1AgTUFQUElORy4KCkJ1ZyBsYXRlbnQgc2luY2UgYjQ4
OGM1ODBhZWYgKDIwMTUpLgotLS0KIHNyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvZXZlbnRf
dHJpZ2dlci5vdXQgfCAxNSArKysrKysrKysrKysrKysKIHNyYy90ZXN0L3JlZ3Jlc3Mvc3Fs
L2V2ZW50X3RyaWdnZXIuc3FsICAgICAgfCAxOCArKysrKysrKysrKysrKysrKysKIDIgZmls
ZXMgY2hhbmdlZCwgMzMgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3Jl
Z3Jlc3MvZXhwZWN0ZWQvZXZlbnRfdHJpZ2dlci5vdXQgYi9zcmMvdGVzdC9yZWdyZXNzL2V4
cGVjdGVkL2V2ZW50X3RyaWdnZXIub3V0CmluZGV4IDE2ZTQ1MzA3MDhjLi4xZjM3ZjRjM2Q1
YSAxMDA2NDQKLS0tIGEvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9ldmVudF90cmlnZ2Vy
Lm91dAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2V2ZW50X3RyaWdnZXIub3V0
CkBAIC04MTcsMyArODE3LDE4IEBAIE5PVElDRTogIERST1AgUE9MSUNZIGRyb3BwZWQgcG9s
aWN5CiBDUkVBVEUgUE9MSUNZIHBndWMgT04gZXZlbnRfdHJpZ2dlcl90ZXN0IFVTSU5HIChG
QUxTRSk7CiBTRVQgZXZlbnRfdHJpZ2dlcnMgPSAnb2ZmJzsKIERST1AgUE9MSUNZIHBndWMg
T04gZXZlbnRfdHJpZ2dlcl90ZXN0OworLS0gVGVzdCB0aGF0IEV2ZW50VHJpZ2dlckNvbGxl
Y3RBbHRlclRTQ29uZmlnIGhhbmRsZXMgRFJPUCBNQVBQSU5HCistLSB3aXRoIG5kaWN0cz0w
LCBkaWN0SWRzPU5VTEwgKHRoZSBEUk9QIE1BUFBJTkcgY29kZSBwYXRoIGFsd2F5cworLS0g
cGFzc2VzIE5VTEwsMCkuICBQcmV2aW91c2x5IGNyYXNoZWQgdW5kZXIgVUJTQU4gZHVlIHRv
CistLSBtZW1jcHkoZGVzdCwgTlVMTCwgMCkgYmVpbmcgdW5kZWZpbmVkIGJlaGF2aW9yLgor
Q1JFQVRFIEZVTkNUSU9OIG5vb3BfZXZlbnRfdHJpZ2dlcigpIFJFVFVSTlMgZXZlbnRfdHJp
Z2dlcgorTEFOR1VBR0UgcGxwZ3NxbCBBUyAkJCBCRUdJTiBFTkQ7ICQkOworQ1JFQVRFIEVW
RU5UIFRSSUdHRVIgbm9vcF9ldmVudF90cmlnZ2VyIE9OIGRkbF9jb21tYW5kX2VuZAorICAg
IEVYRUNVVEUgRlVOQ1RJT04gbm9vcF9ldmVudF90cmlnZ2VyKCk7CitTRVQgZXZlbnRfdHJp
Z2dlcnMgPSAnb24nOworQ1JFQVRFIFRFWFQgU0VBUkNIIENPTkZJR1VSQVRJT04gZXZ0dHJp
Z190c2NmZyAoQ09QWSA9IHBnX2NhdGFsb2cuc2ltcGxlKTsKK0FMVEVSIFRFWFQgU0VBUkNI
IENPTkZJR1VSQVRJT04gZXZ0dHJpZ190c2NmZworICAgIERST1AgTUFQUElORyBGT1Igd29y
ZDsKK0RST1AgVEVYVCBTRUFSQ0ggQ09ORklHVVJBVElPTiBldnR0cmlnX3RzY2ZnOworRFJP
UCBFVkVOVCBUUklHR0VSIG5vb3BfZXZlbnRfdHJpZ2dlcjsKK0RST1AgRlVOQ1RJT04gbm9v
cF9ldmVudF90cmlnZ2VyOwpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvcmVncmVzcy9zcWwvZXZl
bnRfdHJpZ2dlci5zcWwgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9ldmVudF90cmlnZ2VyLnNx
bAppbmRleCBjNjEzYzBjZmQ0My4uZDk1NWIzZDBhYmUgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0
L3JlZ3Jlc3Mvc3FsL2V2ZW50X3RyaWdnZXIuc3FsCisrKyBiL3NyYy90ZXN0L3JlZ3Jlc3Mv
c3FsL2V2ZW50X3RyaWdnZXIuc3FsCkBAIC02MzgsMyArNjM4LDIxIEBAIERST1AgUE9MSUNZ
IHBndWMgT04gZXZlbnRfdHJpZ2dlcl90ZXN0OwogQ1JFQVRFIFBPTElDWSBwZ3VjIE9OIGV2
ZW50X3RyaWdnZXJfdGVzdCBVU0lORyAoRkFMU0UpOwogU0VUIGV2ZW50X3RyaWdnZXJzID0g
J29mZic7CiBEUk9QIFBPTElDWSBwZ3VjIE9OIGV2ZW50X3RyaWdnZXJfdGVzdDsKKworLS0g
VGVzdCB0aGF0IEV2ZW50VHJpZ2dlckNvbGxlY3RBbHRlclRTQ29uZmlnIGhhbmRsZXMgRFJP
UCBNQVBQSU5HCistLSB3aXRoIG5kaWN0cz0wLCBkaWN0SWRzPU5VTEwgKHRoZSBEUk9QIE1B
UFBJTkcgY29kZSBwYXRoIGFsd2F5cworLS0gcGFzc2VzIE5VTEwsMCkuICBQcmV2aW91c2x5
IGNyYXNoZWQgdW5kZXIgVUJTQU4gZHVlIHRvCistLSBtZW1jcHkoZGVzdCwgTlVMTCwgMCkg
YmVpbmcgdW5kZWZpbmVkIGJlaGF2aW9yLgorQ1JFQVRFIEZVTkNUSU9OIG5vb3BfZXZlbnRf
dHJpZ2dlcigpIFJFVFVSTlMgZXZlbnRfdHJpZ2dlcgorTEFOR1VBR0UgcGxwZ3NxbCBBUyAk
JCBCRUdJTiBFTkQ7ICQkOworQ1JFQVRFIEVWRU5UIFRSSUdHRVIgbm9vcF9ldmVudF90cmln
Z2VyIE9OIGRkbF9jb21tYW5kX2VuZAorICAgIEVYRUNVVEUgRlVOQ1RJT04gbm9vcF9ldmVu
dF90cmlnZ2VyKCk7CitTRVQgZXZlbnRfdHJpZ2dlcnMgPSAnb24nOworCitDUkVBVEUgVEVY
VCBTRUFSQ0ggQ09ORklHVVJBVElPTiBldnR0cmlnX3RzY2ZnIChDT1BZID0gcGdfY2F0YWxv
Zy5zaW1wbGUpOworQUxURVIgVEVYVCBTRUFSQ0ggQ09ORklHVVJBVElPTiBldnR0cmlnX3Rz
Y2ZnCisgICAgRFJPUCBNQVBQSU5HIEZPUiB3b3JkOworCitEUk9QIFRFWFQgU0VBUkNIIENP
TkZJR1VSQVRJT04gZXZ0dHJpZ190c2NmZzsKK0RST1AgRVZFTlQgVFJJR0dFUiBub29wX2V2
ZW50X3RyaWdnZXI7CitEUk9QIEZVTkNUSU9OIG5vb3BfZXZlbnRfdHJpZ2dlcjsKLS0gCjIu
NDUuMQoK
--------------rvXMAhf18VxUy9Ukx82eXrSy
Content-Type: text/plain; charset=UTF-8;
 name="v1-0002-Fix-UBSAN-crash-in-EventTriggerCollectAlterTSConf.patch"
Content-Disposition: attachment;
 filename*0="v1-0002-Fix-UBSAN-crash-in-EventTriggerCollectAlterTSConf.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSAwNDM0NGI1N2M3MTcyNzFhMzcyZDFlNjMzNTMwOWUwZmU1MzQ1OGI2IE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBGbG9yaW4gSXJpb24gPGZsb3Jpbi5pcmlvbkBlbnRl
cnByaXNlZGIuY29tPgpEYXRlOiBUdWUsIDMgTWFyIDIwMjYgMTc6NDQ6MTggKzAxMDAKU3Vi
amVjdDogW1BBVENIIHYxIDIvMl0gRml4IFVCU0FOIGNyYXNoIGluIEV2ZW50VHJpZ2dlckNv
bGxlY3RBbHRlclRTQ29uZmlnCgpHdWFyZCB0aGUgcGFsbG9jX2FycmF5ICsgbWVtY3B5IHdp
dGggYW4gbmRpY3RzID4gMCBjaGVjay4gIFRoZSBjb21tYW5kCnN0cnVjdCBpcyBhbHJlYWR5
IHBhbGxvYzAnZCBzbyBkaWN0SWRzIGRlZmF1bHRzIHRvIE5VTEwuCi0tLQogc3JjL2JhY2tl
bmQvY29tbWFuZHMvZXZlbnRfdHJpZ2dlci5jIHwgNyArKysrKy0tCiAxIGZpbGUgY2hhbmdl
ZCwgNSBpbnNlcnRpb25zKCspLCAyIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL3NyYy9i
YWNrZW5kL2NvbW1hbmRzL2V2ZW50X3RyaWdnZXIuYyBiL3NyYy9iYWNrZW5kL2NvbW1hbmRz
L2V2ZW50X3RyaWdnZXIuYwppbmRleCAwMjhmOWUyZGU5MC4uMjg5ODk2N2ZhNjcgMTAwNjQ0
Ci0tLSBhL3NyYy9iYWNrZW5kL2NvbW1hbmRzL2V2ZW50X3RyaWdnZXIuYworKysgYi9zcmMv
YmFja2VuZC9jb21tYW5kcy9ldmVudF90cmlnZ2VyLmMKQEAgLTIwMDQsOCArMjAwNCwxMSBA
QCBFdmVudFRyaWdnZXJDb2xsZWN0QWx0ZXJUU0NvbmZpZyhBbHRlclRTQ29uZmlndXJhdGlv
blN0bXQgKnN0bXQsIE9pZCBjZmdJZCwKIAljb21tYW5kLT5pbl9leHRlbnNpb24gPSBjcmVh
dGluZ19leHRlbnNpb247CiAJT2JqZWN0QWRkcmVzc1NldChjb21tYW5kLT5kLmF0c2NmZy5h
ZGRyZXNzLAogCQkJCQkgVFNDb25maWdSZWxhdGlvbklkLCBjZmdJZCk7Ci0JY29tbWFuZC0+
ZC5hdHNjZmcuZGljdElkcyA9IHBhbGxvY19hcnJheShPaWQsIG5kaWN0cyk7Ci0JbWVtY3B5
KGNvbW1hbmQtPmQuYXRzY2ZnLmRpY3RJZHMsIGRpY3RJZHMsIHNpemVvZihPaWQpICogbmRp
Y3RzKTsKKwlpZiAobmRpY3RzID4gMCkKKwl7CisJCWNvbW1hbmQtPmQuYXRzY2ZnLmRpY3RJ
ZHMgPSBwYWxsb2NfYXJyYXkoT2lkLCBuZGljdHMpOworCQltZW1jcHkoY29tbWFuZC0+ZC5h
dHNjZmcuZGljdElkcywgZGljdElkcywgc2l6ZW9mKE9pZCkgKiBuZGljdHMpOworCX0KIAlj
b21tYW5kLT5kLmF0c2NmZy5uZGljdHMgPSBuZGljdHM7CiAJY29tbWFuZC0+cGFyc2V0cmVl
ID0gKE5vZGUgKikgY29weU9iamVjdChzdG10KTsKIAotLSAKMi40NS4xCgo=

--------------rvXMAhf18VxUy9Ukx82eXrSy--