Tighten array dimensionality checks in Perl -> SQL array conversion.
Tom Lane <tgl@sss.pgh.pa.us>
Tighten array dimensionality checks in Perl -> SQL array conversion. plperl_array_to_datum() wasn't sufficiently careful about checking that nested lists represent a rectangular array structure; it would accept inputs such as "[1, []]". This is a bit related to the PL/Python bug fixed in commit 81eaaf65e, but it doesn't seem to provide any direct route to a memory stomp. Instead the likely failure mode is for makeMdArrayResult to be passed fewer Datums than the claimed array dimensionality requires, possibly leading to a wild pointer dereference and SIGSEGV. Per report from Alexander Lakhin. It's been broken for a long time, so back-patch to all supported branches. Discussion: https://postgr.es/m/5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com
Files
| Path | Change | +/− |
|---|---|---|
| src/pl/plperl/expected/plperl_array.out | modified | +43 −0 |
| src/pl/plperl/plperl.c | modified | +39 −23 |
| src/pl/plperl/sql/plperl_array.sql | modified | +37 −0 |
Discussion
- BUG #17912: Invalid memory access when converting plpython' array containing empty array 12 messages · 2023-04-28 → 2023-05-04