function "cursor_to_xmlschema" causes a crash
yangboyu <yangboyu.yby@alibaba-inc.com>
From: 杨伯宇(长堂) <yangboyu.yby@alibaba-inc.com>
To: "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2023-09-18T05:00:59Z
Lists: pgsql-hackers
Attachments
- 0001-fix-cursor_to_xmlschema-can-cause-a-crash.patch (application/octet-stream) patch 0001
Hello postgres hackers:
I recently notice that function "cursor_to_xmlschema" can lead to a crash if the
cursor parameter points to the query itself. Here is an example:
postgres=# SELECT cursor_to_xmlschema('' :: refcursor, TRUE , FALSE , 'xxx' ) into temp;
server closed the connection unexpectedly
This probably means the server terminated abnormally
before or while processing the request.
The reason could be that this function doesn't ensure the cursor is correctly
opened, as a "select into" statement can't be opened as a cursor. Although it may
be challenging to perform a perfect check in this scenario, it seems sufficient
just to check the tuple descriptor of the portal, since only the query that
returns tuples can be opened as a cursor.
Only in my opinion, self-pointing cursors like this do not make practical sense.
This bug is discovered through randomly generated SQL statements.
Best regards,
Boyu Yang
Commits
-
Don't crash if cursor_to_xmlschema is used on a non-data-returning Portal.
- f73fa5a470b4 17.0 landed
- ec693a3f304c 16.1 landed
- e6e50ada07bb 13.13 landed
- db00be6d7845 11.22 landed
- 9baabfa38e00 14.10 landed
- 95f54f0d034e 15.5 landed
- 1233370791fe 12.17 landed