Thread: BUG #18879: PostgreSQL returns memory error.

The following bug has been logged on the website:

Bug reference:      18879
Logged by:          Yu Liang
Email address:      luy70@psu.edu
PostgreSQL version: 17.4
Operating system:   Ubuntu 24.04 LTS ARM 64 VM
Description:

The latest version of PostgreSQL, when compiling with release build, return
memory error: `pfree called with invalid pointer` when executing the
following queries: 

```sql
DROP DATABASE test123;
CREATE DATABASE test123;
\c test123;
CREATE TABLE v00 (c01 INT, c02 TEXT);
CREATE INDEX i03 ON v00 (c01);
INSERT INTO v00 (c01, c02) VALUES (0, 'abc');
CREATE LOCAL TEMP TABLE IF NOT EXISTS v878825600 ( c878825601 INT
COMPRESSION DEFAULT CONSTRAINT cons_878825602 REFERENCES v878825600 MATCH
SIMPLE ON UPDATE NO ACTION ON DELETE SET DEFAULT ( c878825601, c878825601,
c878825601, c878825601, c878825601, c878825601, c878825601 ) PRIMARY KEY )
ON COMMIT DELETE ROWS;
CREATE LOCAL TEMP TABLE IF NOT EXISTS v878825601 ( c878825601 INT
COMPRESSION DEFAULT CONSTRAINT cons_878825602 REFERENCES v878825600 MATCH
SIMPLE ON UPDATE NO ACTION ON DELETE SET DEFAULT ( c878825601, c878825601,
c878825601, c878825601, c878825601, c878825601, c878825601 ) PRIMARY KEY )
ON COMMIT DELETE ROWS;
CREATE LOCAL TEMP TABLE IF NOT EXISTS v878825602 ( c878825601 INT
COMPRESSION DEFAULT CONSTRAINT cons_878825602 REFERENCES v878825600 MATCH
SIMPLE ON UPDATE NO ACTION ON DELETE SET DEFAULT ( c878825601, c878825601,
c878825601, c878825601, c878825601, c878825601, c878825601 ) PRIMARY KEY )
ON COMMIT DELETE ROWS;
```

In debug build, we also observer an additional assertion failure:
Assert("false"), File:
"/home/postgresql/postgres/bld/../src/backend/access/common/heaptuple.c",
Line: 258

PG Bug reporting form <noreply@postgresql.org> writes:
> CREATE LOCAL TEMP TABLE IF NOT EXISTS v878825600 ( c878825601 INT
> COMPRESSION DEFAULT CONSTRAINT cons_878825602 REFERENCES v878825600 MATCH
> SIMPLE ON UPDATE NO ACTION ON DELETE SET DEFAULT ( c878825601, c878825601,
> c878825601, c878825601, c878825601, c878825601, c878825601 ) PRIMARY KEY )
> ON COMMIT DELETE ROWS;

Thanks for the report.  A less illegible repro is

regression=# create temp table v1 (c1 int primary key references v1 on delete set default (c1,c1));
WARNING:  problem in alloc set PortalContext: detected write past chunk end in block 0x2c25bc0, chunk 0x2c25e20
WARNING:  problem in alloc set PortalContext: detected write past chunk end in block 0x2c25bc0, chunk 0x2c25e20
CREATE TABLE

(With more repetitions of "c1" you can get a crash.)  It looks like
we're not being careful to reject duplicates in the SET DEFAULT list.

            regards, tom lane