At Mon, 05 Jun 2023 11:34:17 +0000, PG Bug reporting form <noreply@postgresql.org> wrote in
> While doing fuzzing testing I've found an input data for poly_contain
> operation that hangs postgresql 11 forever (or for a very long time), with
> backend eating 100% of cpu.
The query leads to infinite loop involving
touched_lseg_inside_poly. Thanks for reporting.
> Sorry there is no file attach option in bug report form.
>
> I guess this issue might be known, as it is not reproducible in latter
> versions, but still I guess it is better to report it.
Thanks! I could reproduce the issue here using it. In this case,
on_ps_internal() gives a wrong result for, for example, the following
input.
point pa {x = 0.011698969004501018, y = -9.0711677068731452e-257}
lseg {p1 {x = -0.0036183721265742744, y = 4.2781805177680175e+48},
p2 {x = 2.4676134855730224e-152, y = 7.6266955589918203e+100}}
The point is evidently not on the lseg, but on_ps_internal(point,
lseg) returns true. Underflow in on_ps_internal() is causing this
mishap.
A feasible fix might be to detect infinite recursion. The attached
works for the this specific case well.
regards.
--
Kyotaro Horiguchi
NTT Open Source Software Center
