Re: BUG #19763: ManualBug2 NULL pointer dereference in make_build_data via examine_expression bypass of lookup_var_a

From: shihao zhong <zhong950419(at)gmail(dot)com>
To: Tomas Vondra <tomas(at)vondra(dot)me>
Cc: 1217816127(at)qq(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org, PG Bug reporting form <noreply(at)postgresql(dot)org>
Subject: Re: BUG #19763: ManualBug2 NULL pointer dereference in make_build_data via examine_expression bypass of lookup_var_a
Date: 2026-10-19 02:43:03
Message-ID: CAGRkXqTTTYgav5f5SRdoMVBc50rmx+L8rwdb38i+qdaixuN1qg@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hi,

> I haven't thought about how to fix it yet - it seems very unlikely a
> typanalyze function would behave like this, but we should be more
> careful.

Here is a patch. It does for examine_expression() what 3b7a6fa1572
did for examine_attribute().

The test adds your typanalyze function to test_custom_types. It runs
your repro and also a single expression object, which builds only
expression statistics.

Thanks,
Shihao

Attachment Content-Type Size
v1-0001-Handle-failed-typanalyze-PG14-16.patch.txt text/plain 8.0 KB
v1-0001-Handle-failed-typanalyze-when-building-extended-s.patch application/octet-stream 8.0 KB

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message shihao zhong 2026-10-19 03:31:35 Re: BUG #19760: CLUSTER loses a row the transaction inserted and then updated in a rolled-back subtransaction
Previous Message Tom Lane 2026-10-19 00:41:05 Re: BUG #19771: to_char(): NUL byte in result for formats with a trailing decimal point (regression from ec352b37d)