| From: | Aleksander Alekseev <aleksander(at)tigerdata(dot)com> |
|---|---|
| To: | PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | [PATCH] Fix segmentation fault and infinite loop in jsonb_{plperl,plpython} |
| Date: | 2026-06-16 14:05:20 |
| Message-ID: | CAJ7c6TPbjkzUk4qJ5dHvDNEz0hBuFue3A-XWz_=897z+BC+z8A@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Hi,
I discovered several bugs in jsonb_plperl and jsonb_plpython.
The first bug causes a segfault when dealing with deeply nested JSONB
values. As an example:
```
$ ./reproduce_stack_overflow.py
plpython3u (depth=100000): SIGSEGV
2026-06-16 16:42:56.989 MSK [3209763] LOG: client backend (PID
3209810) was terminated by signal 11: Segmentation fault
2026-06-16 16:42:56.989 MSK [3209763] DETAIL: Failed process was
running: SELECT py_deep(100000);
plperl (depth=100000): SIGSEGV
2026-06-16 16:42:59.101 MSK [3209763] LOG: client backend (PID
3209827) was terminated by signal 11: Segmentation fault
2026-06-16 16:42:59.101 MSK [3209763] DETAIL: Failed process was
running: SELECT perl_deep(100000);
```
The second bug affects only jsonb_plperl. It's possible to construct a
Perl object with circular references which will cause
SV_to_JsonbValue() to go into an infinite loop here:
```
while (SvROK(in))
in = SvRV(in);
```
The attached script reproduce_circular_ref.py reproduces the issue. Be
careful if you decide to run it because the backend will become
unresponsive to pg_cancel_backend() and you will be unable to stop the
cluster in a standard way.
I suggest fixing it by rewriting the while loop into a recursion with
check_stack_depth() call. This will make the behavior consistent with
jsonb_plpython.
Patches are attached. Thoughts?
--
Best regards,
Aleksander Alekseev
| Attachment | Content-Type | Size |
|---|---|---|
| v1-0002-jsonb_plperl-Replace-reference-unwinding-loop-wit.patch | text/x-patch | 2.0 KB |
| v1-0001-jsonb_plperl-jsonb_plpython-Add-missing-check_sta.patch | text/x-patch | 2.8 KB |
| reproduce_circular_ref.py | text/x-python | 1.0 KB |
| reproduce_stack_overflow.py | text/x-python | 1.8 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Ethan Mertz | 2026-06-16 14:21:34 | Re: [PATCH] Improving index selection for logical replication apply with replica identity full |
| Previous Message | Dilip Kumar | 2026-06-16 13:24:09 | Re: Proposal: Conflict log history table for Logical Replication |