From bc38f7016c868ff1be68214b4a134773cda214cb Mon Sep 17 00:00:00 2001 From: Florin Irion Date: Tue, 3 Mar 2026 17:41:23 +0100 Subject: [PATCH v1 1/2] Add regression test for EventTriggerCollectAlterTSConfig with NULL dictIds The DROP MAPPING code path in tsearchcmds.c calls EventTriggerCollectAlterTSConfig(stmt, cfgId, NULL, 0). When an event trigger on ddl_command_end is active, this reaches memcpy(dest, NULL, 0) which is undefined behavior. Under -fsanitize=undefined this crashes the server. Add a test that exercises this exact code path: a ddl_command_end event trigger combined with ALTER TEXT SEARCH CONFIGURATION ... DROP MAPPING. Bug latent since b488c580aef (2015). --- src/test/regress/expected/event_trigger.out | 15 +++++++++++++++ src/test/regress/sql/event_trigger.sql | 18 ++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/src/test/regress/expected/event_trigger.out b/src/test/regress/expected/event_trigger.out index 16e4530708c..1f37f4c3d5a 100644 --- a/src/test/regress/expected/event_trigger.out +++ b/src/test/regress/expected/event_trigger.out @@ -817,3 +817,18 @@ NOTICE: DROP POLICY dropped policy CREATE POLICY pguc ON event_trigger_test USING (FALSE); SET event_triggers = 'off'; DROP POLICY pguc ON event_trigger_test; +-- Test that EventTriggerCollectAlterTSConfig handles DROP MAPPING +-- with ndicts=0, dictIds=NULL (the DROP MAPPING code path always +-- passes NULL,0). Previously crashed under UBSAN due to +-- memcpy(dest, NULL, 0) being undefined behavior. +CREATE FUNCTION noop_event_trigger() RETURNS event_trigger +LANGUAGE plpgsql AS $$ BEGIN END; $$; +CREATE EVENT TRIGGER noop_event_trigger ON ddl_command_end + EXECUTE FUNCTION noop_event_trigger(); +SET event_triggers = 'on'; +CREATE TEXT SEARCH CONFIGURATION evttrig_tscfg (COPY = pg_catalog.simple); +ALTER TEXT SEARCH CONFIGURATION evttrig_tscfg + DROP MAPPING FOR word; +DROP TEXT SEARCH CONFIGURATION evttrig_tscfg; +DROP EVENT TRIGGER noop_event_trigger; +DROP FUNCTION noop_event_trigger; diff --git a/src/test/regress/sql/event_trigger.sql b/src/test/regress/sql/event_trigger.sql index c613c0cfd43..d955b3d0abe 100644 --- a/src/test/regress/sql/event_trigger.sql +++ b/src/test/regress/sql/event_trigger.sql @@ -638,3 +638,21 @@ DROP POLICY pguc ON event_trigger_test; CREATE POLICY pguc ON event_trigger_test USING (FALSE); SET event_triggers = 'off'; DROP POLICY pguc ON event_trigger_test; + +-- Test that EventTriggerCollectAlterTSConfig handles DROP MAPPING +-- with ndicts=0, dictIds=NULL (the DROP MAPPING code path always +-- passes NULL,0). Previously crashed under UBSAN due to +-- memcpy(dest, NULL, 0) being undefined behavior. +CREATE FUNCTION noop_event_trigger() RETURNS event_trigger +LANGUAGE plpgsql AS $$ BEGIN END; $$; +CREATE EVENT TRIGGER noop_event_trigger ON ddl_command_end + EXECUTE FUNCTION noop_event_trigger(); +SET event_triggers = 'on'; + +CREATE TEXT SEARCH CONFIGURATION evttrig_tscfg (COPY = pg_catalog.simple); +ALTER TEXT SEARCH CONFIGURATION evttrig_tscfg + DROP MAPPING FOR word; + +DROP TEXT SEARCH CONFIGURATION evttrig_tscfg; +DROP EVENT TRIGGER noop_event_trigger; +DROP FUNCTION noop_event_trigger; -- 2.45.1