v1-0001-Add-regression-test-for-EventTriggerCollectAlterT.patch

text/plain

Filename: v1-0001-Add-regression-test-for-EventTriggerCollectAlterT.patch
Type: text/plain
Part: 0
Message: UBSAN crash in EventTriggerCollectAlterTSConfig (memcpy with NULL src)

Patch

Format: format-patch
Series: patch v1-0001
Subject: Add regression test for EventTriggerCollectAlterTSConfig with NULL dictIds
File+
src/test/regress/expected/event_trigger.out 15 0
src/test/regress/sql/event_trigger.sql 18 0
From bc38f7016c868ff1be68214b4a134773cda214cb Mon Sep 17 00:00:00 2001
From: Florin Irion <florin.irion@enterprisedb.com>
Date: Tue, 3 Mar 2026 17:41:23 +0100
Subject: [PATCH v1 1/2] Add regression test for
 EventTriggerCollectAlterTSConfig with NULL dictIds

The DROP MAPPING code path in tsearchcmds.c calls
EventTriggerCollectAlterTSConfig(stmt, cfgId, NULL, 0).  When an event
trigger on ddl_command_end is active, this reaches memcpy(dest, NULL, 0)
which is undefined behavior.  Under -fsanitize=undefined this crashes
the server.

Add a test that exercises this exact code path: a ddl_command_end event
trigger combined with ALTER TEXT SEARCH CONFIGURATION ... DROP MAPPING.

Bug latent since b488c580aef (2015).
---
 src/test/regress/expected/event_trigger.out | 15 +++++++++++++++
 src/test/regress/sql/event_trigger.sql      | 18 ++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/src/test/regress/expected/event_trigger.out b/src/test/regress/expected/event_trigger.out
index 16e4530708c..1f37f4c3d5a 100644
--- a/src/test/regress/expected/event_trigger.out
+++ b/src/test/regress/expected/event_trigger.out
@@ -817,3 +817,18 @@ NOTICE:  DROP POLICY dropped policy
 CREATE POLICY pguc ON event_trigger_test USING (FALSE);
 SET event_triggers = 'off';
 DROP POLICY pguc ON event_trigger_test;
+-- Test that EventTriggerCollectAlterTSConfig handles DROP MAPPING
+-- with ndicts=0, dictIds=NULL (the DROP MAPPING code path always
+-- passes NULL,0).  Previously crashed under UBSAN due to
+-- memcpy(dest, NULL, 0) being undefined behavior.
+CREATE FUNCTION noop_event_trigger() RETURNS event_trigger
+LANGUAGE plpgsql AS $$ BEGIN END; $$;
+CREATE EVENT TRIGGER noop_event_trigger ON ddl_command_end
+    EXECUTE FUNCTION noop_event_trigger();
+SET event_triggers = 'on';
+CREATE TEXT SEARCH CONFIGURATION evttrig_tscfg (COPY = pg_catalog.simple);
+ALTER TEXT SEARCH CONFIGURATION evttrig_tscfg
+    DROP MAPPING FOR word;
+DROP TEXT SEARCH CONFIGURATION evttrig_tscfg;
+DROP EVENT TRIGGER noop_event_trigger;
+DROP FUNCTION noop_event_trigger;
diff --git a/src/test/regress/sql/event_trigger.sql b/src/test/regress/sql/event_trigger.sql
index c613c0cfd43..d955b3d0abe 100644
--- a/src/test/regress/sql/event_trigger.sql
+++ b/src/test/regress/sql/event_trigger.sql
@@ -638,3 +638,21 @@ DROP POLICY pguc ON event_trigger_test;
 CREATE POLICY pguc ON event_trigger_test USING (FALSE);
 SET event_triggers = 'off';
 DROP POLICY pguc ON event_trigger_test;
+
+-- Test that EventTriggerCollectAlterTSConfig handles DROP MAPPING
+-- with ndicts=0, dictIds=NULL (the DROP MAPPING code path always
+-- passes NULL,0).  Previously crashed under UBSAN due to
+-- memcpy(dest, NULL, 0) being undefined behavior.
+CREATE FUNCTION noop_event_trigger() RETURNS event_trigger
+LANGUAGE plpgsql AS $$ BEGIN END; $$;
+CREATE EVENT TRIGGER noop_event_trigger ON ddl_command_end
+    EXECUTE FUNCTION noop_event_trigger();
+SET event_triggers = 'on';
+
+CREATE TEXT SEARCH CONFIGURATION evttrig_tscfg (COPY = pg_catalog.simple);
+ALTER TEXT SEARCH CONFIGURATION evttrig_tscfg
+    DROP MAPPING FOR word;
+
+DROP TEXT SEARCH CONFIGURATION evttrig_tscfg;
+DROP EVENT TRIGGER noop_event_trigger;
+DROP FUNCTION noop_event_trigger;
-- 
2.45.1