Horton

plpython: NULL pointer dereference on broken sequence objects

Richard Guo <guofenglinux@gmail.com>

View thread View on postgr.es
From: Richard Guo <guofenglinux@gmail.com>
To: Pg Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2026-06-25T08:49:31Z
Lists: pgsql-hackers

Attachments

While looking into the recent plperl NULL pointer dereference issue,
which ended up as 4015abe14, I found a similar issue in plpython, with
the help of an LLM tool (Claude 4.8).

There are 6 callers of PySequence_GetItem() in plpython, and none of
them checks the returned result before using it.  PySequence_GetItem()
can return NULL whenever an element cannot be fetched, so an object
that claims a length it cannot actually deliver is enough to crash the
backend.

For example:

  CREATE FUNCTION test() RETURNS int[] AS $$
  class C:
      def __len__(self):
          return 2
      def __getitem__(self, i):
          raise ValueError('boom')
  return C()
  $$ LANGUAGE plpython3u;

  SELECT test();   -- crashes


The attached patch checks the result of PySequence_GetItem() in each
place and errors out if it is NULL.

- Richard

Commits

  1. plpython: Fix NULL pointer dereferences for broken sequence and mapping objects