Bug plperl.c

Mark Murawski <markm-lists@intellasoft.net>

From: Mark Murawski <markm-lists@intellasoft.net>
To: pgsql-bugs@lists.postgresql.org
Date: 2022-02-22T17:49:26Z
Lists: pgsql-bugs

Attachments

Affects Versions: 12 (and probably all others)

Steps to Reproduce:
- Run a query during plperl validation -- ie: inside a warn handler

CREATE OR REPLACE FUNCTION foo() RETURNS text
  LANGUAGE plperlu
AS $function$

use warnings;
use strict;

$SIG{'__WARN__'} = sub {
   my $pid = main::spi_exec_query('SELECT 
pg_backend_pid()')->{rows}[0]{pg_backend_pid};
};

my $foo;
my $foo;  # <---- causes a warning

$function$



2022-02-22 12:17:04 EST -  -  -  - 12950 -  - 0 - LOG:  server process 
(PID 19702) was terminated by signal 11: Segmentation fault


#0   0x00007f32cfc33e65  in  plperl_spi_exec  (query=query@entry=0x55f7157b9290  "pg_backend_pid()",  limit=limit@entry=0)  at  plperl.c:3184
#1   0x00007f32cfc36bbe  in  XS__spi_exec_query  (my_perl=0x55f7157b7490,  cv=<optimized  out>)  at  SPI.xs:38
#2   0x00007f32cf9d85b1  in  Perl_pp_entersub  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#3   0x00007f32cf9ce896  in  Perl_runops_standard  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#4   0x00007f32cf943c85  in  Perl_call_sv  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#5   0x00007f32cf9aff22  in  ??  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#6   0x00007f32cf9b0ce1  in  Perl_vwarn  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#7   0x00007f32cf9b115f  in  Perl_warner  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#8   0x00007f32cf97df83  in  Perl_pad_add_name_pvn  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#9   0x00007f32cf92582d  in  Perl_allocmy  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#10  0x00007f32cf96600b  in  Perl_yylex  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#11  0x00007f32cf978e80  in  Perl_yyparse  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#12  0x00007f32cfa1240f  in  ??  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#13  0x00007f32cfa1dbed  in  Perl_pp_entereval  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#14  0x00007f32cf9ce896  in  Perl_runops_standard  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#15  0x00007f32cf943ea1  in  Perl_call_sv  ()  from  /usr/lib/x86_64-linux-gnu/libperl.so.5.28
#16  0x00007f32cfc2dbf3  in  plperl_create_sub  (
     s=s@entry=0x55f7158d7858  "\n\nuse strict;\nuse warnings;\n\nuse IntellaConfig { ProgramName => 
'PgLiveQueueCreateViews' };\nuse SimpleSPI;\nuse PostgresInfo;\nuse 
UpgradeUtils;\n\nuse Data::Dumper;\nu se JSON;\n\nmy ($cmd) = $_[0] || 
'repla"...,  fn_oid=fn_oid@entry=39623,  prodesc=<optimized  out>,  prodesc=<optimized  out>)  at  plperl.c:2135
#17  0x00007f32cfc2e5d5  in  compile_plperl_function  (fn_oid=fn_oid@entry=39623,  is_trigger=is_trigger@entry=false,  is_event_trigger=is_event_trigger@entry=false)  at  plperl.c:2989
#18  0x00007f32cfc33c98  in  plperl_validator  (fcinfo=<optimized  out>)  at  plperl.c:2053
#19  0x000055f713965590  in  FunctionCall1Coll  (flinfo=0x7ffe96003c50,  collation=<optimized  out>,  arg1=<optimized  out>)  at  fmgr.c:1140
#20  0x000055f713965c4e  in  OidFunctionCall1Coll  (functionId=functionId@entry=24589,  collation=collation@entry=0,  arg1=arg1@entry=39623)  at  fmgr.c:1418
#21  0x000055f7136228a5  in  ProcedureCreate  (procedureName=<optimized  out>,  procNamespace=procNamespace@entry=39605,  replace=<optimized  out>,  returnsSet=returnsSet@entry=false,
     returnType=returnType@entry=25,  proowner=16385,  languageObjectId=24590,  languageValidator=24589,
     prosrc=0x55f7157c1408  "\n\nuse strict;\nuse warnings;\n\nuse IntellaConfig { ProgramName => 
'PgLiveQueueCreateViews' };\nuse SimpleSPI;\nuse PostgresInfo;\nuse 
UpgradeUtils;\n\nuse Data::Dumper;\nuse JSON;\n\nmy ($cmd) = $_[0] || 
'repla"...,  probin=0x0,  prokind=102  'f',  security_definer=false,  isLeakProof=false,  isStrict=false,  volatility=118  'v',  parallel=117  'u',  parameterTypes=0x55f7156f12d0,
     allParameterTypes=0,  parameterModes=0,  parameterNames=94519704883840,  parameterDefaults=0x0,  trftypes=0,  proconfig=0,  prosupport=0,  procost=procost@entry=100,  prorows=prorows@entry=0)
     at  pg_proc.c:726
#22  0x000055f71369a3d0  in  CreateFunction  (pstate=pstate@entry=0x55f7156f0bf0,  stmt=stmt@entry=0x55f7156d2e48)  at  functioncmds.c:1152
#23  0x000055f71384786e  in  ProcessUtilitySlow  (pstate=pstate@entry=0x55f7156f0bf0,  pstmt=pstmt@entry=0x55f7156d3188,
     queryString=queryString@entry=0x7f32cfc3e048  "CREATE OR REPLACE FUNCTION live_queue.create_views(cmd text)\n RETURNS 
text\n LANGUAGE plperlu\nAS $function$\n\nuse strict;\nuse 
warnings;\n\nuse Intella Config { ProgramName => 
'PgLiveQueueCreateViews' };\nus"...,  context=context@entry=PROCESS_UTILITY_TOPLEVEL,  params=params@entry=0x0,  queryEnv=queryEnv@entry=0x0,  completionTag=0x7ffe96004620  "",
     dest=0x55f7156d3268)  at  utility.c:1521
#24  0x000055f7138465d2  in  standard_ProcessUtility  (pstmt=0x55f7156d3188,
     queryString=0x7f32cfc3e048  "CREATE OR REPLACE FUNCTION live_queue.create_views(cmd text)\n RETURNS 
text\n LANGUAGE plperlu\nAS $function$\n\nuse strict;\nuse 
warnings;\n\nuse IntellaConfig { ProgramNa --Type <RET> for more, q to 
quit, c to continue without paging--
me => 'PgLiveQueueCreateViews' };\nus"...,  context=PROCESS_UTILITY_TOPLEVEL,  params=0x0,  queryEnv=0x0,  dest=0x55f7156d3268,  completionTag=0x7ffe96004620  "")  at  utility.c:927
#25  0x000055f7138449aa  in  PortalRunUtility  (portal=portal@entry=0x55f7157666f0,  pstmt=pstmt@entry=0x55f7156d3188,  isTopLevel=isTopLevel@entry=true,  setHoldSnapshot=setHoldSnapshot@entry=false,  dest=0x55f7156d3268,
     completionTag=0x7ffe96004620  "")  at  pquery.c:1171
#26  0x000055f713844af5  in  PortalRunMulti  (portal=portal@entry=0x55f7157666f0,  isTopLevel=isTopLevel@entry=true,  setHoldSnapshot=setHoldSnapshot@entry=false,  dest=dest@entry=0x55f7156d3268,
     altdest=altdest@entry=0x55f7156d3268,  completionTag=completionTag@entry=0x7ffe96004620  "")  at  pquery.c:1327
#27  0x000055f713844fa1  in  PortalRun  (portal=portal@entry=0x55f7157666f0,  count=count@entry=9223372036854775807,  isTopLevel=isTopLevel@entry=true,  run_once=run_once@entry=true,  dest=dest@entry=0x55f7156d3268,
     altdest=altdest@entry=0x55f7156d3268,  completionTag=0x7ffe96004620  "")  at  pquery.c:805
#28  0x000055f71384107d  in  exec_simple_query  (
     query_string=0x7f32cfc3e048  "CREATE OR REPLACE FUNCTION live_queue.create_views(cmd text)\n RETURNS 
text\n LANGUAGE plperlu\nAS $function$\n\nuse strict;\nuse 
warnings;\n\nuse IntellaConfig { ProgramName => 'PgLiveQueueCreateViews' 
};\nus"...)  at  postgres.c:1215
#29  0x000055f7138429d1  in  PostgresMain  (argc=<optimized  out>,  argv=argv@entry=0x55f715723a78,  dbname=<optimized  out>,  username=<optimized  out>)  at  postgres.c:4271
#30  0x000055f7137ce4d9  in  BackendRun  (port=0x55f715716ad0,  port=0x55f715716ad0)  at  postmaster.c:4510
#31  BackendStartup  (port=0x55f715716ad0)  at  postmaster.c:4193
#32  ServerLoop  ()  at  postmaster.c:1725
#33  0x000055f7137cf400  in  PostmasterMain  (argc=5,  argv=0x55f7156cd030)  at  postmaster.c:1398
#34  0x000055f71355bcca  in  main  (argc=5,  argv=0x55f7156cd030)  at  main.c:228' Culprit: plperl_spi_exec(char *query, int limit) 
....snip.... PG_TRY(); ...snip.... spi_rv = SPI_execute(query, 
current_call_data->prodesc->fn_readonly, limit); Fix: bool read_only = 
(current_call_data ? current_call_data->prodesc->fn_readonly : 0); 
...snip... spi_rv = SPI_execute(query, read_only, limit); Attached patch 
against 12.10

Commits

  1. Disallow execution of SPI functions during plperl function compilation.