UBSAN crash in EventTriggerCollectAlterTSConfig (memcpy with NULL src)

From: Florin Irion <irionr(at)gmail(dot)com>
To: pgsql-hackers(at)lists(dot)postgresql(dot)org
Cc: Álvaro Herrera <alvherre(at)kurilemu(dot)de>
Subject: UBSAN crash in EventTriggerCollectAlterTSConfig (memcpy with NULL src)
Date: 2026-03-03 17:33:40
Message-ID: c6fff161-9aee-4290-9ada-71e21e4d84de@gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

While working on the pg_get_domain_ddl() patch [1], I installed an
event trigger on ddl_command_end in test_setup.sql to automatically
round-trip DDL. This triggered a UBSAN crash on CI [2] that turns out
to be a pre-existing bug since b488c580aef(?).

The DROP MAPPING code path in tsearchcmds.c unconditionally calls:

```
EventTriggerCollectAlterTSConfig(stmt, cfgId, NULL, 0);
```

Inside EventTriggerCollectAlterTSConfig(), this reaches:

```
command->d.atscfg.dictIds = palloc_array(Oid, ndicts); /* ndicts=0 */
memcpy(command->d.atscfg.dictIds, dictIds, sizeof(Oid) * ndicts);
^^^^^^^ NULL
```

Under -fsanitize=undefined this triggers SIGABRT and crashes the server.

The bug has been latent for 11 years because without an active event
trigger, currentEventTriggerState is NULL and the function returns early
at the top, never reaching the memcpy. The standard regression suite
never had an event trigger installed during the tsdicts test — until now.

Reproducer (crashes only under UBSAN) and patch attached:

This affects all branches back to 9.5 where b488c580aef landed.

[1] https://www.postgresql.org/message-id/CAPgqM1V4LW2qiDLPsusb7s0kYbSDJjH5Tt%2B-ZzVmPU7xV0TJNQ%40mail.gmail.com
[2] https://cirrus-ci.com/task/6170470552174592

--

Cheers,
Florin

EDB -- www.enterprisedb.com

Attachment Content-Type Size
v1-0001-Add-regression-test-for-EventTriggerCollectAlterT.patch text/plain 3.2 KB
v1-0002-Fix-UBSAN-crash-in-EventTriggerCollectAlterTSConf.patch text/plain 1.3 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Florin Irion 2026-03-03 17:35:18 Re: [PATCH] pg_get_domain_ddl: DDL reconstruction function for CREATE DOMAIN statement
Previous Message Joel Jacobson 2026-03-03 17:33:31 Re: [BUG?] estimate_hash_bucket_stats uses wrong ndistinct for avgfreq