From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
---|---|
To: | pgsql-committers(at)postgresql(dot)org |
Subject: | pgsql: Fix plpython crash when returning string representation of a REC |
Date: | 2015-08-21 16:22:04 |
Message-ID: | E1ZSp4u-0001Dr-1x@gemulon.postgresql.org |
Views: | Whole Thread | Raw Message | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers |
Fix plpython crash when returning string representation of a RECORD result.
PLyString_ToComposite() blithely overwrote proc->result.out.d, even though
for a composite result type the other union variant proc->result.out.r is
the one that should be valid. This could result in a crash if out.r had
in fact been filled in (proc->result.is_rowtype == 1) and then somebody
later attempted to use that data; as per bug #13579 from Paweł Michalak.
Just to add insult to injury, it didn't work for RECORD results anyway,
because record_in() would refuse the case.
Fix by doing the I/O function lookup in a local PLyTypeInfo variable,
as we were doing already in PLyObject_ToComposite(). This is not a great
technique because any fn_extra data allocated by the input function will
be leaked permanently (thanks to using TopMemoryContext as fn_mcxt).
But that's a pre-existing issue that is much less serious than a crash,
so leave it to be fixed separately.
This bug would be a potential security issue, except that plpython is
only available to superusers and the crash requires coding the function
in a way that didn't work before today's patches.
Add regression test cases covering all the supported methods of converting
composite results.
Back-patch to 9.1 where the faulty coding was introduced.
Branch
------
REL9_1_STABLE
Details
-------
http://git.postgresql.org/pg/commitdiff/1d190d095ff8e7d11877fc7d4dc82727871a91c1
Modified Files
--------------
src/pl/plpython/expected/plpython_composite.out | 206 +++++++++++++++++++++++
src/pl/plpython/plpython.c | 14 +-
src/pl/plpython/sql/plpython_composite.sql | 41 +++++
3 files changed, 259 insertions(+), 2 deletions(-)
From | Date | Subject | |
---|---|---|---|
Next Message | Alvaro Herrera | 2015-08-21 17:16:13 | pgsql: Remove ExecGetScanType function |
Previous Message | Tom Lane | 2015-08-21 16:22:03 | pgsql: Fix plpython crash when returning string representation of a REC |