Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with malformed JSONPath containing non-existent variables - Mailing list pgsql-bugs

Hi Andrey,

On Fri, Jun 5, 2026 at 7:03 PM Andrey Rachitskiy <pl0h0yp1@gmail.com> wrote:
> The growing allocation is leaked temporary JsonValueLists in executePredicate() (local lseq/rseq, ~1482–1547) and the
arithmetichelpers executeBinaryArithmExpr() / executeUnaryArithmExpr() (~1561–1684). Each nested comparison or
arithmeticsubexpression materializes operands via executeItemOptUnwrapResult[NoThrow]() → executeNextItem() →
JsonValueListAppend()(~1165, ~2451), but the interim lists are never freed before return. For @? specifically,
executeJsonPath()also leaks a local vals list in strict exists mode (~579–586). 
>
> Missing vars make the AFL case worse by returning null instead of error, so evaluation continues deep into nested
$?()/comparisonsinstead of stopping at the first $"…" reference. The same leak mechanism is reachable without missing
vars— Tom Lane demonstrated this on master (5a2043bf713) with $[*] ? (@ < $) on a large array. 
>
> Our missing-variable patch fixes the reported OOM and the @? semantics bug by aborting early. Whether REL_14/15/16
alsoneed a broader fix for interim JsonValueList cleanup is beyond what I can confidently propose; I've tried to pin
downwhere the growth happens for that discussion. 

Thanks for that tracedown and for pointing to Tom's commit. The deeper
interim-JsonValueList leak looks unlikely to get fixed in the back
branches; Tom's cleanup (5a2043bf713) went only to master.

I'll look at committing the attached revised version of your Apr 20
patch (same fix, plus a regression test) down to REL_14. Please
check/test.

--
Thanks, Amit Langote