agora inbox for pgsql-hackers@postgresql.org
help / color / mirror / Atom feed[PATCH v3] contrib/sslinfo: Add ssl_group_info
331+ messages / 3 participants
[nested] [flat]
* [PATCH v3] contrib/sslinfo: Add ssl_group_info
@ 2026-02-19 15:33 Dmitrii Dolgov <9erthalion6@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Dmitrii Dolgov @ 2026-02-19 15:33 UTC (permalink / raw)
Add a new function to sslinfo ssl_group_info to show SSL groups,
including negotiated, supported and shared. It's useful for diagnostic
purposes, to identify what's being used and supported, e.g. which key
share is being negotiated. Few examples, for openssl 3.2.4:
select * from ssl_group_info();
type | name
------------+--------------------
negotiated | X25519MLKEM768
shared | X25519MLKEM768
shared | x25519
supported | X25519MLKEM768
supported | x25519
[...]
The implementation is inspired by ssl_print_groups from openssl.
---
contrib/sslinfo/Makefile | 2 +-
contrib/sslinfo/meson.build | 2 +-
contrib/sslinfo/sslinfo--1.2--1.3.sql | 10 ++
contrib/sslinfo/sslinfo.c | 167 +++++++++++++++++++++++++-
contrib/sslinfo/sslinfo.control | 2 +-
doc/src/sgml/sslinfo.sgml | 45 +++++++
src/tools/pgindent/typedefs.list | 1 +
7 files changed, 225 insertions(+), 4 deletions(-)
create mode 100644 contrib/sslinfo/sslinfo--1.2--1.3.sql
diff --git a/contrib/sslinfo/Makefile b/contrib/sslinfo/Makefile
index 14305594e2d..dc837209c93 100644
--- a/contrib/sslinfo/Makefile
+++ b/contrib/sslinfo/Makefile
@@ -6,7 +6,7 @@ OBJS = \
sslinfo.o
EXTENSION = sslinfo
-DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
+DATA = sslinfo--1.2--1.3.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
PGFILEDESC = "sslinfo - information about client SSL certificate"
ifdef USE_PGXS
diff --git a/contrib/sslinfo/meson.build b/contrib/sslinfo/meson.build
index 6e9cb96430a..29c7da44228 100644
--- a/contrib/sslinfo/meson.build
+++ b/contrib/sslinfo/meson.build
@@ -25,7 +25,7 @@ contrib_targets += sslinfo
install_data(
'sslinfo--1.0--1.1.sql',
'sslinfo--1.1--1.2.sql',
- 'sslinfo--1.2.sql',
+ 'sslinfo--1.2--1.3.sql',
'sslinfo.control',
kwargs: contrib_data_args,
)
diff --git a/contrib/sslinfo/sslinfo--1.2--1.3.sql b/contrib/sslinfo/sslinfo--1.2--1.3.sql
new file mode 100644
index 00000000000..40fd0ea2b9c
--- /dev/null
+++ b/contrib/sslinfo/sslinfo--1.2--1.3.sql
@@ -0,0 +1,10 @@
+/* contrib/sslinfo/sslinfo--1.2--1.3.sql */
+
+-- complain if script is sourced in psql, rather than via ALTER EXTENSION
+\echo Use "ALTER EXTENSION sslinfo UPDATE TO '1.3'" to load this file. \quit
+
+CREATE FUNCTION
+ssl_group_info(OUT group_type text, OUT name text
+) RETURNS SETOF record
+AS 'MODULE_PATHNAME', 'ssl_group_info'
+LANGUAGE C STRICT PARALLEL RESTRICTED;
diff --git a/contrib/sslinfo/sslinfo.c b/contrib/sslinfo/sslinfo.c
index 2b9eb90b093..e018010d4be 100644
--- a/contrib/sslinfo/sslinfo.c
+++ b/contrib/sslinfo/sslinfo.c
@@ -28,13 +28,28 @@ static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
static Datum ASN1_STRING_to_text(ASN1_STRING *str);
/*
- * Function context for data persisting over repeated calls.
+ * Function context for data persisting over repeated calls of
+ * ssl_extension_info.
*/
typedef struct
{
TupleDesc tupdesc;
} SSLExtensionInfoContext;
+/*
+ * Function context for data persisting over repeated calls of
+ * ssl_group_info.
+ */
+typedef struct
+{
+ TupleDesc tupdesc;
+ int nshared;
+ int nsupported;
+
+ /* Supported groups have to be stored separately */
+ int *supported_groups;
+} SSLGroupInfoContext;
+
/*
* Indicates whether current session uses SSL
*
@@ -474,3 +489,153 @@ ssl_extension_info(PG_FUNCTION_ARGS)
/* All done */
SRF_RETURN_DONE(funcctx);
}
+
+/*
+ * Returns information about TLS groups.
+ *
+ * Returns setof record made of the following values:
+ * - type of the group: negotiated, shared, supported.
+ * - name of the group.
+ */
+PG_FUNCTION_INFO_V1(ssl_group_info);
+Datum
+ssl_group_info(PG_FUNCTION_ARGS)
+{
+ SSL *ssl = MyProcPort->ssl;
+ FuncCallContext *funcctx;
+ int call_cntr = 0;
+ int max_calls = 0;
+ MemoryContext oldcontext;
+ SSLGroupInfoContext *fctx;
+
+ if (SRF_IS_FIRSTCALL())
+ {
+
+ TupleDesc tupdesc;
+
+ /* create a function context for cross-call persistence */
+ funcctx = SRF_FIRSTCALL_INIT();
+
+ /*
+ * Switch to memory context appropriate for multiple function calls
+ */
+ oldcontext = MemoryContextSwitchTo(funcctx->multi_call_memory_ctx);
+
+ /* Create a user function context for cross-call persistence */
+ fctx = palloc_object(SSLGroupInfoContext);
+
+ /* Construct tuple descriptor */
+ if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
+ ereport(ERROR,
+ (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ errmsg("function returning record called in context that cannot accept type record")));
+ fctx->tupdesc = BlessTupleDesc(tupdesc);
+
+ if (!MyProcPort->ssl_in_use)
+ {
+ /* fast track when no results */
+ MemoryContextSwitchTo(oldcontext);
+ SRF_RETURN_DONE(funcctx);
+ }
+
+ if (ssl != NULL)
+ {
+ fctx->nsupported = SSL_get1_groups(ssl, NULL);
+ fctx->nshared = SSL_get_shared_group(ssl, -1);
+
+ fctx->supported_groups =
+ palloc(fctx->nsupported * sizeof(*fctx->supported_groups));
+ SSL_get1_groups(ssl, fctx->supported_groups);
+
+ /*
+ * Set max_calls as the number of supported groups plus the number
+ * of shared groups plus one negotiated group.
+ */
+ max_calls = fctx->nsupported + fctx->nshared + 1;
+ }
+
+ if (max_calls > 0)
+ {
+ /* got results, keep track of them */
+ funcctx->max_calls = max_calls;
+ funcctx->user_fctx = fctx;
+ }
+ else
+ {
+ /* fast track when no results */
+ MemoryContextSwitchTo(oldcontext);
+ SRF_RETURN_DONE(funcctx);
+ }
+
+ MemoryContextSwitchTo(oldcontext);
+ }
+
+ /* stuff done on every call of the function */
+ funcctx = SRF_PERCALL_SETUP();
+
+ /*
+ * Initialize per-call variables.
+ */
+ call_cntr = funcctx->call_cntr;
+ max_calls = funcctx->max_calls;
+ fctx = funcctx->user_fctx;
+
+ /* do while there are more left to send */
+ if (call_cntr < max_calls)
+ {
+ Datum values[2];
+ bool nulls[2];
+ HeapTuple tuple;
+ Datum result,
+ group_type;
+ int nid;
+ const char *group_name;
+
+ /* Send the negotiated group first */
+ if (call_cntr == 0)
+ {
+ nid = SSL_get_negotiated_group(ssl);
+ group_type = CStringGetTextDatum("negotiated");
+ }
+ /* Then the shared groups */
+ else if (call_cntr < fctx->nshared + 1)
+ {
+ nid = SSL_get_shared_group(ssl, call_cntr - 1);
+ group_type = CStringGetTextDatum("shared");
+ }
+ /* And finally the supported groups */
+ else if (call_cntr < fctx->nsupported + fctx->nshared + 1)
+ {
+ nid = fctx->supported_groups[call_cntr - fctx->nshared - 1];
+ group_type = CStringGetTextDatum("supported");
+ }
+ else
+ SRF_RETURN_DONE(funcctx);
+
+ /*
+ * SSL_group_to_name can return NULL in case of an error, e.g. when no
+ * such name was registered for some reason.
+ */
+ group_name = SSL_group_to_name(ssl, nid);
+ if (group_name == NULL)
+ ereport(ERROR,
+ (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+ errmsg("unknown OpenSSL group at position %d",
+ call_cntr)));
+
+ values[0] = group_type;
+ nulls[0] = false;
+
+ values[1] = CStringGetTextDatum(group_name);
+ nulls[1] = false;
+
+ /* Build tuple */
+ tuple = heap_form_tuple(fctx->tupdesc, values, nulls);
+ result = HeapTupleGetDatum(tuple);
+
+ SRF_RETURN_NEXT(funcctx, result);
+ }
+
+ /* All done */
+ SRF_RETURN_DONE(funcctx);
+}
diff --git a/contrib/sslinfo/sslinfo.control b/contrib/sslinfo/sslinfo.control
index c7754f924cf..b53e95b7da8 100644
--- a/contrib/sslinfo/sslinfo.control
+++ b/contrib/sslinfo/sslinfo.control
@@ -1,5 +1,5 @@
# sslinfo extension
comment = 'information about SSL certificates'
-default_version = '1.2'
+default_version = '1.3'
module_pathname = '$libdir/sslinfo'
relocatable = true
diff --git a/doc/src/sgml/sslinfo.sgml b/doc/src/sgml/sslinfo.sgml
index 85d49f66537..422745de37c 100644
--- a/doc/src/sgml/sslinfo.sgml
+++ b/doc/src/sgml/sslinfo.sgml
@@ -240,6 +240,51 @@ emailAddress
</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>
+ <function>ssl_group_info() returns setof record</function>
+ <indexterm>
+ <primary>ssl_group_info</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Provide information about TLS groups: group type and group name.
+ The group type value could be one of the following:
+
+ <variablelist>
+ <varlistentry id="ssl-group-info-negotiated">
+ <term><literal>negotiated</literal></term>
+ <listitem>
+ <para>
+ The group used for the handshake key exchange process.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry id="ssl-group-info-shared">
+ <term><literal>shared</literal></term>
+ <listitem>
+ <para>
+ Lisf of named groups shared with the server side.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry id="ssl-group-info-supported">
+ <term><literal>supported</literal></term>
+ <listitem>
+ <para>
+ list of named groups supported by the client for key exchange in the
+ form of "supported_groups" extension.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</sect2>
diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list
index 52f8603a7be..b5ea3c18291 100644
--- a/src/tools/pgindent/typedefs.list
+++ b/src/tools/pgindent/typedefs.list
@@ -2720,6 +2720,7 @@ SQLValueFunction
SQLValueFunctionOp
SSL
SSLExtensionInfoContext
+SSLGroupInfoContext
SSL_CTX
STARTUPINFO
STRLEN
base-commit: e82fc27e095b5a84c578b6e6b43b3396463bd812
--
2.52.0
--fucpmbwjcehrmjf7--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:13 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:13 UTC (permalink / raw)
When a PL/Perl function returns a very large text value, sv2cstr() copies
the entire Perl string into backend memory with no size check. A user
with permission to create untrusted PL/Perl functions can return strings
far larger than work_mem and risk getting the backend killed by the OOM
killer.
Reject Perl strings larger than work_mem * 1024 bytes, capped by
MaxAllocSize, before copying them through sv2cstr(). This follows the
same work_mem-based limit pattern used elsewhere in the backend.
Add a plperl regression test that attempts to return a 16MB string with
the default 4MB work_mem setting.
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/pl/plperl/expected/plperl.out | 8 +++++++
src/pl/plperl/plperl.h | 34 ++++++++++++++++++++++++++++++
src/pl/plperl/sql/plperl.sql | 7 ++++++
3 files changed, 49 insertions(+)
diff --git a/src/pl/plperl/expected/plperl.out b/src/pl/plperl/expected/plperl.out
index e3d7c88..50c788b 100644
--- a/src/pl/plperl/expected/plperl.out
+++ b/src/pl/plperl/expected/plperl.out
@@ -792,3 +792,11 @@ SELECT self_modify(42);
126
(1 row)
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+SELECT perl_oversized_text();
+ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
+HINT: Increase work_mem or reduce the result size.
+CONTEXT: PL/Perl function "perl_oversized_text"
diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index 4c03f9e..1ccce6d 100644
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -17,6 +17,8 @@
/* defines free() by way of system headers, so must be included before perl.h */
#include "mb/pg_wchar.h"
+#include "miscadmin.h"
+#include "utils/memutils.h"
/*
* Pull in Perl headers via a wrapper header, to control the scope of
@@ -40,6 +42,36 @@ char *plperl_sv_to_literal(SV *, char *);
void plperl_util_elog(int level, SV *msg);
+/*
+ * Maximum byte size for a Perl scalar copied through sv2cstr().
+ *
+ * This follows the same work_mem * 1024 pattern used elsewhere in the
+ * backend (e.g. reorderbuffer.c, nodeHash.c) and is capped by MaxAllocSize.
+ */
+static inline Size
+plperl_max_scalar_bytes(void)
+{
+ Size limit = (Size) work_mem * (Size) 1024;
+
+ return Min(limit, MaxAllocSize - 1);
+}
+
+/*
+ * Reject Perl strings that are too large to copy into backend memory.
+ */
+static inline void
+plperl_check_sv_length(STRLEN len)
+{
+ Size max_len = plperl_max_scalar_bytes();
+
+ if ((Size) len > max_len)
+ erereport(ERROR,
+ (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+ errmsg("Perl value exceeds maximum allowed size (%zu bytes)",
+ max_len),
+ errhint("Increase work_mem or reduce the result size.")));
+}
+
/* helper functions */
/*
@@ -127,6 +159,8 @@ sv2cstr(SV *sv)
else
val = SvPVutf8(sv, len);
+ plperl_check_sv_length(len);
+
/*
* Now convert to database encoding. We use perl's length in the event we
* had an embedded null byte to ensure we error out properly.
diff --git a/src/pl/plperl/sql/plperl.sql b/src/pl/plperl/sql/plperl.sql
index bb0b8ce..0470a2b 100644
--- a/src/pl/plperl/sql/plperl.sql
+++ b/src/pl/plperl/sql/plperl.sql
@@ -521,3 +521,10 @@ $$ LANGUAGE plperl;
SELECT self_modify(42);
SELECT self_modify(42);
+
+-- oversized text results are rejected at the PL boundary
+CREATE OR REPLACE FUNCTION perl_oversized_text() RETURNS text AS $$
+ return 'x' x (16 * 1024 * 1024);
+$$ LANGUAGE plperl;
+
+SELECT perl_oversized_text();
--MP_/sDTAhto+gkG/PMs8Alw6m8e--
^ permalink raw reply [nested|flat] 331+ messages in thread
* [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-06 22:41 Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 1 reply; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-06 22:41 UTC (permalink / raw)
To: ; +Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>; Nikolay Shaplov <dhyan@nataraj.su>
Hi, Hackers!
When a PL/Perl function returns a large text value, sv2cstr() copies the
entire Perl string into backend memory with no size check. The helper
is used on the path from Perl return values and SPI arguments to
PostgreSQL text datums; it simply palloc()s a copy after SvPVutf8().
A user who is allowed to create untrusted PL/Perl functions can
therefore force the backend to allocate strings far larger than any
session limit. On a memory-constrained host this can get the backend
process killed by the OOM killer (SIGKILL) rather than raising a
catchable PostgreSQL error.
Reproducer (unpatched master, plperl enabled):
CREATE FUNCTION perl_huge_text() RETURNS text LANGUAGE plperl
AS $$ return 'x' x (1024 * 1024 * 1024);
$$;
SELECT perl_huge_text();
On a container limited to about 768MB RAM, CREATE FUNCTION alone is
enough to lose the backend:
LOG: client backend (PID ...) was terminated by signal 9: Killed
DETAIL: Failed process was running: CREATE OR REPLACE FUNCTION ...
With plenty of free RAM the same code may succeed instead, which I think
shows missing enforcement rather than an intentional "no limit" design:
other PL/Perl paths already enforce bounds (MAXDIM, AV_SIZE_MAX for SPI
results, max_stack_depth in recursive conversion), but sv2cstr() had
none.
This patch rejects Perl strings larger than work_mem * 1024 bytes,
capped by MaxAllocSize, before copying them through sv2cstr(). That
follows the same work_mem-based pattern used elsewhere in the backend
for per-query working storage. The check is done after SvPVutf8() has
reported the length but before utf_u2e() allocates the
database-encoding copy. A plperl regression test returns a 16MB string
with the default 4MB work_mem and expects:
ERROR: Perl value exceeds maximum allowed size (4194304 bytes)
HINT: Increase work_mem or reduce the result size.
Legitimate functions that need to move more data can raise work_mem for
the session, consistent with other operations bounded by that GUC.
Comments welcome.
--
Regards,
Andrey Rachitskiy
^ permalink raw reply [nested|flat] 331+ messages in thread
* Re: [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-07 01:56 Tom Lane <tgl@sss.pgh.pa.us>
parent: Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 1 reply; 331+ messages in thread
From: Tom Lane @ 2026-07-07 01:56 UTC (permalink / raw)
To: Andrey Rachitskiy <pl0h0yp1@gmail.com>; +Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>; Nikolay Shaplov <dhyan@nataraj.su>
Andrey Rachitskiy <pl0h0yp1@gmail.com> writes:
> When a PL/Perl function returns a large text value, sv2cstr() copies the
> entire Perl string into backend memory with no size check. The helper
> is used on the path from Perl return values and SPI arguments to
> PostgreSQL text datums; it simply palloc()s a copy after SvPVutf8().
> A user who is allowed to create untrusted PL/Perl functions can
> therefore force the backend to allocate strings far larger than any
> session limit. On a memory-constrained host this can get the backend
> process killed by the OOM killer (SIGKILL) rather than raising a
> catchable PostgreSQL error.
This is true of very many operations in PG, not only PL/Perl.
Our general answer to that is to disable memory overcommit
so that the OOM killer won't apply. One should also note that
the same PL/Perl function can (try to) allocate enormous amounts
of memory entirely within Perl, where we have no ability to stop
it. I don't see how constraining the size of a function result
string helps noticeably.
> This patch rejects Perl strings larger than work_mem * 1024 bytes,
Our normal understanding of work_mem is that it's a point beyond which
we'll spill to disk, or otherwise try to reduce our memory consumption
at the cost of longer runtime. Not a point at which an outright query
failure is OK.
So, even if I thought this were something we should address,
I don't believe this is an appropriate approach to a fix.
regards, tom lane
^ permalink raw reply [nested|flat] 331+ messages in thread
* Re: [PATCH] Limit PL/Perl scalar copies to work_mem
@ 2026-07-07 05:44 Andrey Rachitskiy <pl0h0yp1@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 331+ messages in thread
From: Andrey Rachitskiy @ 2026-07-07 05:44 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>; Nikolay Shaplov <dhyan@nataraj.su>
Thanks for the review, Tom.
You're right that work_mem is a poor fit for a hard failure here, and
more generally that this isn't the sort of problem PL/Perl can solve
with a small boundary check alone. I should have raised the idea on
the list for discussion before sending a patch — I'll do that next time
rather than charging ahead with a fix.
Thanks for the feedback.
On Mon, 06 Jul 2026 21:56:17 -0400, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Andrey Rachitskiy <pl0h0yp1@gmail.com> writes:
> > When a PL/Perl function returns a large text value, sv2cstr()
> > copies the entire Perl string into backend memory with no size
> > check. The helper is used on the path from Perl return values and
> > SPI arguments to PostgreSQL text datums; it simply palloc()s a copy
> > after SvPVutf8(). A user who is allowed to create untrusted PL/Perl
> > functions can therefore force the backend to allocate strings far
> > larger than any session limit. On a memory-constrained host this
> > can get the backend process killed by the OOM killer (SIGKILL)
> > rather than raising a catchable PostgreSQL error.
>
> This is true of very many operations in PG, not only PL/Perl.
> Our general answer to that is to disable memory overcommit
> so that the OOM killer won't apply. One should also note that
> the same PL/Perl function can (try to) allocate enormous amounts
> of memory entirely within Perl, where we have no ability to stop
> it. I don't see how constraining the size of a function result
> string helps noticeably.
>
> > This patch rejects Perl strings larger than work_mem * 1024 bytes,
>
> Our normal understanding of work_mem is that it's a point beyond which
> we'll spill to disk, or otherwise try to reduce our memory consumption
> at the cost of longer runtime. Not a point at which an outright query
> failure is OK.
>
> So, even if I thought this were something we should address,
> I don't believe this is an appropriate approach to a fix.
>
> regards, tom lane
--
Regards,
Andrey Rachitskiy
^ permalink raw reply [nested|flat] 331+ messages in thread
end of thread, other threads:[~2026-07-07 05:44 UTC | newest]
Thread overview: 331+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-02-19 15:33 [PATCH v3] contrib/sslinfo: Add ssl_group_info Dmitrii Dolgov <9erthalion6@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:13 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-06 22:41 [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-07-07 01:56 ` Re: [PATCH] Limit PL/Perl scalar copies to work_mem Tom Lane <tgl@sss.pgh.pa.us>
2026-07-07 05:44 ` Re: [PATCH] Limit PL/Perl scalar copies to work_mem Andrey Rachitskiy <pl0h0yp1@gmail.com>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox