Horton

Re: function lca('{}'::ltree[]) caused DB Instance crash

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pierre Ducroquet <p.psql@pinaraf.info>
Cc: pgsql-hackers@postgresql.org, Oleg Bartunov <obartunov@gmail.com>, Teodor Sigaev <teodor@sigaev.ru>
Date: 2018-07-13T14:26:56Z
Lists: pgsql-bugs, pgsql-hackers 
Pierre Ducroquet <p.psql@pinaraf.info> writes:
> On Friday, July 13, 2018 12:09:20 PM CEST 李海龙 wrote:
>> contrib_regression=# select lca('{}'::ltree[]);
>> server closed the connection unexpectedly

> There is indeed a bug. The _lca function in _ltree_op.c tries to allocate 0 
> bytes of memory, doesn't initialize it and dereference it in lca_inner.
> The attached basic patch fixes it.

I think the defense ought to be in lca_inner not there.

However, I don't understand why this code is returning NULL, rather than
a zero-length ltree, in the case that there's no common prefix.  That
doesn't seem consistent to me.

			regards, tom lane

Commits

  1. Fix crash in contrib/ltree's lca() function for empty input array.