BUG #18077: PostgreSQL server subprocess crashed by a SELECT statement with WITH clause
The Post Office <noreply@postgresql.org>
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: fuboat@outlook.com
Date: 2023-08-30T06:32:43Z
Lists: pgsql-bugs
The following bug has been logged on the website: Bug reference: 18077 Logged by: Jingzhou Fu Email address: fuboat@outlook.com PostgreSQL version: 15.4 Operating system: Ubuntu 20.04 x64 Description: PostgreSQL server subprocess crashed by a SELECT statement with WITH clause. It did not affect the main process. It can be reproduced on PostgreSQL 15.4. PoC: ```sql WITH x ( x ) AS ( SELECT ( 1 , 'x' ) ) SELECT FROM x WHERE ( SELECT FROM ( SELECT x ) x WHERE ( SELECT x ( x ) ) ) ``` Backtrace of the crashed subprocess: ``` #0 0x957879 (GetRTEByRangeTablePosn+0x209) #1 0x96ef5c (expandRecordVariable+0x16c) #2 0x96f2d0 (expandRecordVariable+0x4e0) #3 0x96f2d0 (expandRecordVariable+0x4e0) #4 0x9468bc (ParseComplexProjection+0xbc) #5 0x943823 (ParseFuncOrColumn+0x1123) #6 0x93866a (transformExprRecurse+0x38ba) #7 0x934d5b (transformExpr+0x4b) #8 0x96a439 (transformTargetList+0x519) #9 0x8c5835 (transformStmt+0x4b45) #10 0x8c0cb0 (parse_sub_analyze+0xa0) #11 0x936713 (transformExprRecurse+0x1963) #12 0x934d5b (transformExpr+0x4b) #13 0x913509 (transformWhereClause+0x49) #14 0x8c589a (transformStmt+0x4baa) #15 0x8c0cb0 (parse_sub_analyze+0xa0) #16 0x936713 (transformExprRecurse+0x1963) #17 0x934d5b (transformExpr+0x4b) #18 0x913509 (transformWhereClause+0x49) #19 0x8c589a (transformStmt+0x4baa) #20 0x8bfa85 (parse_analyze_fixedparams+0x305) #21 0x11c3f00 (exec_simple_query+0xd40) #22 0x11bdfb4 (PostgresMain+0x2d94) #23 0xf91d9e (BackendRun+0x7e) #24 0xf9b7be (ServerLoop+0x20ae) #25 0xf94094 (PostmasterMain+0x2264) #26 0xd04462 (main+0x452) #27 0x7f3ab3637083 (__libc_start_main+0xf3) #28 0x4a0c4e (_start+0x2e) ```
Commits
-
Track nesting depth correctly when drilling down into RECORD Vars.
- e0e492e5a928 17.0 landed
- d29812c0c6cd 12.17 landed
- c5b7f791dab9 13.13 landed
- ae13f8166dc3 14.10 landed
- a374f6c61681 11.22 landed
- 53630f12d39b 16.1 landed
- 2679a107a152 15.5 landed
-
Fix get_expr_result_type() to find field names for RECORD Consts.
- 8a15b4178c40 12.17 landed
- 59bc0dfe44a6 13.13 landed
- 479b99125dcc 11.22 landed
-
Allow extracting fields from a ROW() expression in more cases.
- ece1154f4c89 11.22 landed
- 2f02d4a2b9cb 12.17 landed