BUG #17908: plpython_to_hstore() crashes with a non-dict argument

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: exclusion(at)gmail(dot)com
Subject: BUG #17908: plpython_to_hstore() crashes with a non-dict argument
Date: 2023-04-25 13:00:02
Message-ID: 17908-3f19a125d56a11d6@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 17908
Logged by: Alexander Lakhin
Email address: exclusion(at)gmail(dot)com
PostgreSQL version: 15.2
Operating system: Ubuntu 22.04
Description:

When executing the following query:
CREATE EXTENSION hstore_plpython3u CASCADE;
CREATE FUNCTION test_transform() RETURNS hstore
LANGUAGE plpython3u
TRANSFORM FOR TYPE hstore AS 'return "a"';
SELECT test_transform();

The server crashes with the stack trace:
Core was generated by `postgres: law regression [local] SELECT
'.
Program terminated with signal SIGABRT, Aborted.

warning: Section `.reg-xstate/3829693' in core file too small.
#0 __pthread_kill_implementation (no_tid=0, signo=6,
threadid=140451453683648) at ./nptl/pthread_kill.c:44
44 ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6,
threadid=140451453683648) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=140451453683648) at
./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=140451453683648, signo=signo(at)entry=6) at
./nptl/pthread_kill.c:89
#3 0x00007fbd66427476 in __GI_raise (sig=sig(at)entry=6) at
../sysdeps/posix/raise.c:26
#4 0x00007fbd6640d7f3 in __GI_abort () at ./stdlib/abort.c:79
#5 0x000055eb85f693d7 in __sanitizer::Abort() ()
#6 0x000055eb85f67271 in __sanitizer::Die() ()
#7 0x000055eb85f49707 in
__asan::ScopedInErrorReport::~ScopedInErrorReport() ()
#8 0x000055eb85f490b6 in
__asan::ReportDeadlySignal(__sanitizer::SignalContext const&) ()
#9 0x000055eb85f48702 in __asan::AsanOnDeadlySignal(int, void*, void*) ()
#10 <signal handler called>
#11 0x00007fbd1b2c15c8 in PyList_GetItem () from
/usr/lib/x86_64-linux-gnu/libpython3.10.so.1.0
#12 0x00007fbd6410ed7f in plpython_to_hstore (fcinfo=0x7ffdc25d0460) at
hstore_plpython.c:154
#13 0x000055eb88fcf3a6 in FunctionCall1Coll (flinfo=0x625000177268,
collation=0, arg1=140450178140016) at fmgr.c:1124
#14 0x00007fbd1b8194b4 in PLyObject_ToTransform (arg=0x625000177248,
plrv=0x7fbd1afa0770, isnull=0x625000184174, inarray=false) at
plpy_typeio.c:1124
#15 0x00007fbd1b80be9d in PLy_output_convert (arg=0x625000177248,
val=0x7fbd1afa0770, isnull=0x625000184174) at plpy_typeio.c:122
#16 0x00007fbd1b7e06fd in PLy_exec_function (fcinfo=0x625000184158,
proc=0x625000177220) at plpy_exec.c:235
#17 0x00007fbd1b7efa3a in plpython3_call_handler (fcinfo=0x625000184158) at
plpy_main.c:247
#18 0x000055eb872ab667 in ExecInterpExpr (state=0x625000184070,
econtext=0x625000183d70, isnull=0x7ffdc25d48a0) at execExprInterp.c:727
#19 0x000055eb872a3a4a in ExecInterpExprStillValid (state=0x625000184070,
econtext=0x625000183d70, isNull=0x7ffdc25d48a0) at execExprInterp.c:1826
#20 0x000055eb875a34cd in ExecEvalExprSwitchContext (state=0x625000184070,
econtext=0x625000183d70, isNull=0x7ffdc25d48a0) at
../../../src/include/executor/executor.h:341
#21 0x000055eb875a3024 in ExecProject (projInfo=0x625000184068) at
../../../src/include/executor/executor.h:375
#22 0x000055eb875a1f5c in ExecResult (pstate=0x625000183c58) at
nodeResult.c:136
#23 0x000055eb87376877 in ExecProcNodeFirst (node=0x625000183c58) at
execProcnode.c:464
#24 0x000055eb873393a4 in ExecProcNode (node=0x625000183c58) at
../../../src/include/executor/executor.h:259
#25 0x000055eb8731c58c in ExecutePlan (estate=0x625000183a20,
planstate=0x625000183c58, use_parallel_mode=false, operation=CMD_SELECT,
sendTuples=true, numberTuples=0, direction=ForwardScanDirection,
dest=0x625000181968,
execute_once=true) at execMain.c:1636
#26 0x000055eb8731bd92 in standard_ExecutorRun (queryDesc=0x6190000015a0,
direction=ForwardScanDirection, count=0, execute_once=true) at
execMain.c:363
#27 0x000055eb8731adb3 in ExecutorRun (queryDesc=0x6190000015a0,
direction=ForwardScanDirection, count=0, execute_once=true) at
execMain.c:307
#28 0x000055eb8843a4c9 in PortalRunSelect (portal=0x62500002aa20,
forward=true, count=0, dest=0x625000181968) at pquery.c:924
#29 0x000055eb8843887c in PortalRun (portal=0x62500002aa20,
count=9223372036854775807, isTopLevel=true, run_once=true,
dest=0x625000181968, altdest=0x625000181968, qc=0x7ffdc25d5900) at
pquery.c:768
#30 0x000055eb88422fff in exec_simple_query (query_string=0x625000005220
"SELECT test_transform();") at postgres.c:1250
#31 0x000055eb884205c9 in PostgresMain (dbname=0x629000011278 "regression",
username=0x629000011258 "law") at postgres.c:4593
#32 0x000055eb87ed06f1 in BackendRun (port=0x615000002b00) at
postmaster.c:4511
#33 0x000055eb87ece7f0 in BackendStartup (port=0x615000002b00) at
postmaster.c:4239
#34 0x000055eb87ec9c10 in ServerLoop () at postmaster.c:1806
#35 0x000055eb87ec41d7 in PostmasterMain (argc=3, argv=0x6030000006d0) at
postmaster.c:1478
#36 0x000055eb8770321b in main (argc=3, argv=0x6030000006d0) at main.c:202

(gdb) frame 12
#12 0x00007fbd6410ed7f in plpython_to_hstore (fcinfo=0x7ffdc25d0460) at
hstore_plpython.c:154
154 tuple = PyList_GetItem(items, i);
(gdb) print items
$1 = (PyObject * volatile) 0x0

Here plpython_to_hstore() has got a string as an argument, but failed to
detect that it's not a dictionary.
With plpython2 (on REL_14_STABLE) I get:
ERROR: not a Python mapping
CONTEXT: while creating return value
PL/Python function "test_transform"

As noted in https://bugs.python.org/issue5945, the behaviour of
PyMapping_Check() changed in Python 3, so it can't be used anymore to
differentiate real dictionaries from strings or alike.

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message PG Bug reporting form 2023-04-27 03:44:04 BUG #17909: CREATE SCHEMA AUTHORIZATION sch CREATE TABLE foo ( id INT ) will coredump
Previous Message Kyotaro Horiguchi 2023-04-25 04:14:52 Re: BUG #17903: There is a bug in the KeepLogSeg()