Re: TupleDescAttr bounds checks

Alexander Law <exclusion@gmail.com>

From: Alexander Lakhin <exclusion@gmail.com>
To: Robert Haas <robertmhaas@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2026-04-04T14:00:00Z
Lists: pgsql-hackers
Hello Robert,

24.03.2026 12:45, Robert Haas wrote:
> On Sun, Mar 22, 2026 at 11:54 PM Tom Lane<tgl@sss.pgh.pa.us> wrote:
>>   Anyway, you should get this fix pushed.
> Done, and I'll plan to commit the other patches later today.

I've found a way to trigger the Assert added in c98ad086a:
CREATE TABLE t(i int);
COPY t FROM stdin WHERE tableoid > 0;
server closed the connection unexpectedly

(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007066d0e4527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007066d0e288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x0000609680cc7fcf in ExceptionalCondition (
     conditionName=conditionName@entry=0x609680d2c104 "i >= 0 && i < tupdesc->natts",
     fileName=fileName@entry=0x609680d84568 "../../../src/include/access/tupdesc.h", lineNumber=lineNumber@entry=182)
     at assert.c:65
#6  0x00006096808c8f68 in TupleDescAttr (tupdesc=<optimized out>, i=<optimized out>)
     at ../../../src/include/access/tupdesc.h:182
#7  TupleDescAttr (i=<optimized out>, tupdesc=<optimized out>) at ../../../src/include/access/tupdesc.h:178
#8  DoCopy (pstate=0x6096a749dc90, stmt=0x6096a74ca120, stmt_location=0, stmt_len=40, processed=0x7ffd3b09b450) at 
copy.c:180
#9  0x0000609680b6b82a in standard_ProcessUtility (pstmt=0x6096a74ca1f0,
     queryString=0x6096a74c9520 "COPY t FROM stdin WHERE tableoid > 0;", readOnlyTree=<optimized out>,
     context=PROCESS_UTILITY_TOPLEVEL, params=0x0, queryEnv=0x0, dest=0x6096a74ca5b0, qc=0x7ffd3b09b6f0) at utility.c:743
#10 0x0000609680b6990c in PortalRunUtility (portal=portal@entry=0x6096a756a070, pstmt=pstmt@entry=0x6096a74ca1f0,
     isTopLevel=isTopLevel@entry=true, setHoldSnapshot=setHoldSnapshot@entry=false, dest=dest@entry=0x6096a74ca5b0,
     qc=qc@entry=0x7ffd3b09b6f0) at pquery.c:1148
...

Best regards,
Alexander

Commits

  1. Avoid unsafe access to negative index in a TupleDesc.

  2. Disallow system columns in COPY FROM WHERE conditions.

  3. Add a test for creating an index on a whole-row expression.

  4. Bounds-check access to TupleDescAttr with an Assert.

  5. Prevent spurious "indexes on virtual generated columns are not supported".