Thread: BUG #17998: Postgres crashes when executing WorkTableScan.

BUG #17998: Postgres crashes when executing WorkTableScan.

From
PG Bug reporting form
Date:
The following bug has been logged on the website:

Bug reference:      17998
Logged by:          Jerry
Email address:      chenglin-liang@outlook.com
PostgreSQL version: Unsupported/Unknown
Operating system:   Ubuntu 18.04.6
Description:

I developed a fuzzing tool that skips the optimizer and directly uses the
correct physical plan to fuzz postgres, and found a crash caused by
executing WorkTableScan.
For detailed steps to reproduce, see the
link:https://github.com/chenglinLiang/pg-report.

-- Environment --
PG version: 10.23
Platform: Ubuntu 18.04.6
Kernel: Linux 5.15.0-75-generic


回复: BUG #17998: Postgres crashes when executing WorkTableScan.

From
梁 成林
Date:
Since pg is tested directly using the physical plan, the executed SQL includes a complete physical plan, and the abbreviated physical plan is:
WORKTABLESCAN{targetlist=[TargetEntry{targetexpr=CONST{constvalue ="61",consttype ="int4"},targetresname="Z",resjunk=False}],qual=[],wtParam = 59}


发件人: PG Bug reporting form <noreply@postgresql.org>
发送时间: 2023年6月26日 3:47
收件人: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
抄送: chenglin-liang@outlook.com <chenglin-liang@outlook.com>
主题: BUG #17998: Postgres crashes when executing WorkTableScan.
 
The following bug has been logged on the website:

Bug reference:      17998
Logged by:          Jerry
Email address:      chenglin-liang@outlook.com
PostgreSQL version: Unsupported/Unknown
Operating system:   Ubuntu 18.04.6
Description:       

I developed a fuzzing tool that skips the optimizer and directly uses the
correct physical plan to fuzz postgres, and found a crash caused by
executing WorkTableScan.
For detailed steps to reproduce, see the
link:https://github.com/chenglinLiang/pg-report.

-- Environment --
PG version: 10.23
Platform: Ubuntu 18.04.6
Kernel: Linux 5.15.0-75-generic

Re: BUG #17998: Postgres crashes when executing WorkTableScan.

From
Heikki Linnakangas
Date:
On 26/06/2023 06:47, PG Bug reporting form wrote:
> I developed a fuzzing tool that skips the optimizer and directly uses the
> correct physical plan to fuzz postgres, and found a crash caused by
> executing WorkTableScan.
> For detailed steps to reproduce, see the
> link:https://github.com/chenglinLiang/pg-report.

You need to provide some evidence that the plan your fuzzer generated is 
valid, ie. something that could be produced by the planner. At a quick 
glance, you have a WorkTableScan with no RecursiveUnion, which is bogus.

-- 
Heikki Linnakangas
Neon (https://neon.tech)