BUG #16171: Potential malformed JSON in explain output

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: mahadevan(at)rapidloop(dot)com
Subject: BUG #16171: Potential malformed JSON in explain output
Date: 2019-12-18 10:28:43
Message-ID: 16171-b72259ab75505fa2@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-bugs pgsql-hackers

The following bug has been logged on the website:

Bug reference: 16171
Logged by: Mahadevan Ramachandran
Email address: mahadevan(at)rapidloop(dot)com
PostgreSQL version: 12.1
Operating system: any

Refer src/backend/commands/explain.c, version 12.1.

When a plan node has children, the function ExplainNode starts a JSON array
with the key "Plans" (line 1955), like so:

"Plans": [

with the intention of creating an array of "Plan" objects, one for each

"Plans": [
{ .. a child plan goes here ..},
{ .. a child plan goes here ..}

However, if the node (the current, parent one) is of a certain type (see
switch at line 1975), then ExplainMemberNodes is called, which does this
(lines 3335-6):

if (nsubnodes < nplans)
ExplainPropertyInteger("Subplans Removed", NULL, nplans - nsubnodes,

This can potentially cause a malformed JSON output like this:

"Plans": [
{ .. a child plan goes here ..},
"Subplans Removed": 5,
{ .. a child plan goes here ..}

I don't have a sample explain output that exhibits this error, this was
found while reviewing the code.


Browse pgsql-bugs by date

  From Date Subject
Next Message hubert depesz lubaczewski 2019-12-18 14:06:31 Re: Fwd: weird long time query
Previous Message Alvaro Herrera 2019-12-18 09:56:45 Re: A row-level trigger on a partitioned table is not created on a sub-partition created later

Browse pgsql-hackers by date

  From Date Subject
Next Message Amit Kapila 2019-12-18 10:57:55 jacana seems to be failing in recoverycheck from last few runs
Previous Message Ranier Vilela 2019-12-18 10:28:21 RE: [PATCH] Windows port add support to BCryptGenRandom