Segfault in backend CTE code

From: Phil Sorber <phil(at)omniti(dot)com>
To: pgsql-bugs(at)postgresql(dot)org
Subject: Segfault in backend CTE code
Date: 2012-01-24 05:29:32
Message-ID: CADAkt-iWfSvovEMd4-sT15OQ+YK4FC_YbZDefxwUK5EwrWe4bA@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Running Postgres 9.1.2.

I've attached a backtrace. Looking at the backtrace it looks like
ExecGetResultType() gets called with a NULL planstate and causes the
segmentation fault:

https://github.com/postgres/postgres/blob/master/src/backend/executor/execUtils.c#L470

Following the stack I see that an optimization for writeable CTE's
inserts a NULL subplanstate:

https://github.com/postgres/postgres/blob/master/src/backend/executor/execMain.c#L2344

ExecInitCteScan() is what eventually passes it to ExecGetResultType():

https://github.com/postgres/postgres/blob/master/src/backend/executor/nodeCtescan.c#L255

I've also attached a proposed fix. In this optimized case it says that
we won't ever use the subplan anyway, so I figured that not setting
the scan tuple type won't matter. I also added an Assert() to
ExecGetResultType(). I modified the declaration of 'slot' to remove a
compiler warning. This patch is against master but should backport to
9.1 cleanly. It also passed all regression tests. If you end up using
this patch please also credit Rick Pufky who helped me with this.

Attachment Content-Type Size
backtrace.txt text/plain 6.2 KB
fix_CTE_NULL_PTR_deref.patch text/x-patch 1.6 KB

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tom Lane 2012-01-24 05:43:08 Re: Segfault in backend CTE code
Previous Message Bridget Frey 2012-01-23 20:22:14 Re: BUG #6200: standby bad memory allocations on SELECT