pgsql: postgres_fdw: Fix crash when estimating joins with functions

From: Fujii Masao <fujii(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: postgres_fdw: Fix crash when estimating joins with functions
Date: 2026-09-10 00:48:10
Message-ID: E1x4SxV-00000004CiD-25AJ@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

postgres_fdw: Fix crash when estimating joins with functions

Commit 0ee83dd4a99 allowed postgres_fdw to push down inner joins between
foreign tables and functions in FROM clauses to the remote server.
However, planning such a join with use_remote_estimate enabled could
cause a segmentation fault. For example, the following query crashed
when ft had use_remote_estimate set to true:

EXPLAIN SELECT * FROM generate_series(1, 3) g JOIN ft ON ft.i = g;

The crash occurred because init_func_stub_fpinfo() copied the connection
information and options from the foreign side to the function-side stub,
but omitted the user mapping, leaving it NULL. When the function was the
outer side of the join, the join inherited this NULL mapping and passed it
to GetConnection() when requesting a remote estimate, causing a
segmentation fault.

Fix this by having init_func_stub_fpinfo() also copy the user mapping
from the foreign side.

Author: Fujii Masao <masao(dot)fujii(at)gmail(dot)com>
Reviewed-by: Alexander Pyhalov <a(dot)pyhalov(at)postgrespro(dot)ru>
Discussion: https://postgr.es/m/CAHGQGwGE9xPzCke0C0r4omTkh-hU08aBd2j9oSA0FYmJLCf9jA@mail.gmail.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/3430fba3b0f0655e203a4b03dd531d7bcad86ff3

Modified Files
--------------
contrib/postgres_fdw/postgres_fdw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Richard Guo 2026-09-10 01:04:21 pgsql: Fix duplicate enforcement of EC-derived conditions
Previous Message Michael Paquier 2026-09-10 00:43:36 pgsql: Widen Object ID counter to 8 bytes