Horton

Fix list-manipulation bug in WITH RECURSIVE processing.

Tom Lane <tgl@sss.pgh.pa.us>

View on postgr.es
Commit: 80ca8464fe02296c8efefd53746e6d6a3f456d1e
Author: Tom Lane <tgl@sss.pgh.pa.us>
Date: 2021-02-26T01:47:32Z
Releases: 14.0 
Fix list-manipulation bug in WITH RECURSIVE processing.

makeDependencyGraphWalker and checkWellFormedRecursionWalker
thought they could hold onto a pointer to a list's first
cons cell while the list was modified by recursive calls.
That was okay when the cons cell was actually separately
palloc'd ... but since commit 1cff1b95a, it's quite unsafe,
leading to core dumps or incorrect complaints of faulty
WITH nesting.

In the field this'd require at least a seven-deep WITH nest
to cause an issue, but enabling DEBUG_LIST_MEMORY_USAGE
allows the bug to be seen with lesser nesting depths.

Per bug #16801 from Alexander Lakhin.  Back-patch to v13.

Michael Paquier and Tom Lane

Discussion: https://postgr.es/m/16801-393c7922143eaa4d@postgresql.org

Files

PathChange+/−
src/backend/parser/parse_cte.c modified +6 −6
src/test/regress/expected/with.out modified +59 −0
src/test/regress/sql/with.sql modified +44 −0

Discussion