[PATCH] Fix segmentation fault and infinite loop in jsonb_{plperl,plpython}

From: Aleksander Alekseev <aleksander(at)tigerdata(dot)com>
To: PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: [PATCH] Fix segmentation fault and infinite loop in jsonb_{plperl,plpython}
Date: 2026-06-16 14:05:20
Message-ID: CAJ7c6TPbjkzUk4qJ5dHvDNEz0hBuFue3A-XWz_=897z+BC+z8A@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

I discovered several bugs in jsonb_plperl and jsonb_plpython.

The first bug causes a segfault when dealing with deeply nested JSONB
values. As an example:

```
$ ./reproduce_stack_overflow.py
plpython3u (depth=100000): SIGSEGV
2026-06-16 16:42:56.989 MSK [3209763] LOG: client backend (PID
3209810) was terminated by signal 11: Segmentation fault
2026-06-16 16:42:56.989 MSK [3209763] DETAIL: Failed process was
running: SELECT py_deep(100000);
plperl (depth=100000): SIGSEGV
2026-06-16 16:42:59.101 MSK [3209763] LOG: client backend (PID
3209827) was terminated by signal 11: Segmentation fault
2026-06-16 16:42:59.101 MSK [3209763] DETAIL: Failed process was
running: SELECT perl_deep(100000);
```

The second bug affects only jsonb_plperl. It's possible to construct a
Perl object with circular references which will cause
SV_to_JsonbValue() to go into an infinite loop here:

```
while (SvROK(in))
in = SvRV(in);
```

The attached script reproduce_circular_ref.py reproduces the issue. Be
careful if you decide to run it because the backend will become
unresponsive to pg_cancel_backend() and you will be unable to stop the
cluster in a standard way.

I suggest fixing it by rewriting the while loop into a recursion with
check_stack_depth() call. This will make the behavior consistent with
jsonb_plpython.

Patches are attached. Thoughts?

--
Best regards,
Aleksander Alekseev

Attachment Content-Type Size
v1-0002-jsonb_plperl-Replace-reference-unwinding-loop-wit.patch text/x-patch 2.0 KB
v1-0001-jsonb_plperl-jsonb_plpython-Add-missing-check_sta.patch text/x-patch 2.8 KB
reproduce_circular_ref.py text/x-python 1.0 KB
reproduce_stack_overflow.py text/x-python 1.8 KB

Browse pgsql-hackers by date

  From Date Subject
Next Message Ethan Mertz 2026-06-16 14:21:34 Re: [PATCH] Improving index selection for logical replication apply with replica identity full
Previous Message Dilip Kumar 2026-06-16 13:24:09 Re: Proposal: Conflict log history table for Logical Replication