BUG #5307: Crash in AllocSetAlloc

The following bug has been logged online:

Bug reference: 5307
Logged by: Igor Lasic
Email address: igor(at)a-bb(dot)net
PostgreSQL version: 8.3.7
Operating system: Linux
Description: Crash in AllocSetAlloc
Details:

We have an application running C-API stored procedures. After running for a
while postgres crashes with:

If I increase shared memory application runs longer but eventually crashes.

---------------------------------------------
2010-02-01 10:56:08.689 UTC LOG: server process (PID 12925) was
terminated by signal 11: Segmentation fault
2010-02-01 10:56:08.689 UTC LOG: terminating any other active server
processes
ipdr ipdr 2010-02-01 10:56:08.689 UTC WARNING: terminating connection
because of crash of another server process
ipdr ipdr 2010-02-01 10:56:08.689 UTC DETAIL: The postmaster has commanded
this server process to roll back the current transaction and exit, b\
ecause another server process exited abnormally and possibly corrupted
shared memory.

--------------------------------------------

(gdb) where
#0 AllocSetAlloc (context=0xb5dd1b0, size=703) at aset.c:747
#1 0x00000000004aaed2 in scanner_init (
str=0xb6038b0 "SELECT NULL::int2 AS cnn_servicedirection, NULL::inet AS
cnn_cmtsipaddress, NULL::oid AS cnn_cmtsmdifindex, NULL::varcha\
r AS cnn_serviceclassname, NULL::macaddr AS cnn_cmmacaddress, NULL::int4 AS
cnn"...) at scan.l:829
#2 0x00000000004bc268 in raw_parser (str=0xfaf60a53212c42ed <Address
0xfaf60a53212c42ed out of bounds>) at parser.c:51
#3 0x00000000005ab435 in pg_parse_query (
query_string=0xb6038b0 "SELECT NULL::int2 AS cnn_servicedirection,
NULL::inet AS cnn_cmtsipaddress, NULL::oid AS cnn_cmtsmdifindex, NUL\
L::varchar AS cnn_serviceclassname, NULL::macaddr AS cnn_cmmacaddress,
NULL::int4 AS cnn"...) at postgres.c:554
#4 0x0000000000530977 in _SPI_prepare_plan (src=0xfaf60a53212c42ed <Address
0xfaf60a53212c42ed out of bounds>, plan=0x7) at spi.c:1475
#5 0x00000000005324f0 in SPI_execute (
src=0xb6038b0 "SELECT NULL::int2 AS cnn_servicedirection, NULL::inet AS
cnn_cmtsipaddress, NULL::oid AS cnn_cmtsmdifindex, NULL::varcha\
r AS cnn_serviceclassname, NULL::macaddr AS cnn_cmmacaddress, NULL::int4 AS
cnn"..., read_only=1 '\001', tcount=1) at spi.c:340
#6 0x00002b1fc13b0e0b in ?? ()
#7 0x0000000000000064 in ?? ()