Skip to content

Commit ba38d6d

Browse files
Zainab-Saadmarkgomer
Zainab-Saad
authored and
markgomer
committed
Fix issue 1303: Server crashes on executing SELECT * FROM agtype(null); (apache#1317)
* Add additional checks for Const expression nodes for which the walker code would crash. * The server crashes for few other expr types too including Const, OpExpr, Var, BoolExpr and CoerceViaIO for which checks are added * Add regression tests
1 parent 6508e35 commit ba38d6d

File tree

3 files changed

+213
-6
lines changed

3 files changed

+213
-6
lines changed

‎regress/expected/expr.out

+156
Original file line numberDiff line numberDiff line change
@@ -7304,6 +7304,152 @@ SELECT results, pg_typeof(user) FROM cypher('issue_1124', $$ MATCH (u) RETURN u
73047304
{"id": 281474976710657, "label": "", "properties": {}}::vertex | name
73057305
(1 row)
73067306

7307+
--
7308+
-- issue 1303: segmentation fault on queries like SELECT * FROM agtype(null);
7309+
--
7310+
-- Test Const and CoerceViaIO expression node types
7311+
SELECT * FROM agtype(null);
7312+
agtype
7313+
--------
7314+
7315+
(1 row)
7316+
7317+
SELECT * FROM agtype('1');
7318+
agtype
7319+
--------
7320+
1
7321+
(1 row)
7322+
7323+
SELECT * FROM agtype('[1, 2, 3]');
7324+
agtype
7325+
-----------
7326+
[1, 2, 3]
7327+
(1 row)
7328+
7329+
SELECT * FROM agtype('{"a": 1}');
7330+
agtype
7331+
----------
7332+
{"a": 1}
7333+
(1 row)
7334+
7335+
SELECT * FROM agtype('{"id": 844424930131971, "label": "v", "properties": {"i": 1}}::vertex');
7336+
agtype
7337+
-----------------------------------------------------------------------
7338+
{"id": 844424930131971, "label": "v", "properties": {"i": 1}}::vertex
7339+
(1 row)
7340+
7341+
SELECT * FROM agtype('{"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge');
7342+
agtype
7343+
---------------------------------------------------------------------------------------------------------------------------
7344+
{"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge
7345+
(1 row)
7346+
7347+
SELECT * FROM agtype('[{"id": 1125899906842625, "label": "v1", "properties": {"id": "initial"}}::vertex, {"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge, {"id": 1125899906842626, "label": "v1", "properties": {"id": "middle"}}::vertex, {"id": 1407374883553281, "label": "e1", "end_id": 1125899906842627, "start_id": 1125899906842626, "properties": {}}::edge, {"id": 1125899906842627, "label": "v1", "properties": {"id": "end"}}::vertex]::path');
7348+
agtype
7349+
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
7350+
[{"id": 1125899906842625, "label": "v1", "properties": {"id": "initial"}}::vertex, {"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge, {"id": 1125899906842626, "label": "v1", "properties": {"id": "middle"}}::vertex, {"id": 1407374883553281, "label": "e1", "end_id": 1125899906842627, "start_id": 1125899906842626, "properties": {}}::edge, {"id": 1125899906842627, "label": "v1", "properties": {"id": "end"}}::vertex]::path
7351+
(1 row)
7352+
7353+
SELECT * FROM text(1);
7354+
text
7355+
------
7356+
1
7357+
(1 row)
7358+
7359+
SELECT * FROM text('1');
7360+
text
7361+
------
7362+
1
7363+
(1 row)
7364+
7365+
SELECT * FROM int4(1);
7366+
int4
7367+
------
7368+
1
7369+
(1 row)
7370+
7371+
SELECT * FROM json('1');
7372+
json
7373+
------
7374+
1
7375+
(1 row)
7376+
7377+
SELECT * FROM jsonb('1');
7378+
jsonb
7379+
-------
7380+
1
7381+
(1 row)
7382+
7383+
SELECT * FROM bytea('1');
7384+
bytea
7385+
-------
7386+
\x31
7387+
(1 row)
7388+
7389+
-- Test Var expression node types
7390+
SELECT create_graph('issue_1303');
7391+
NOTICE: graph "issue_1303" has been created
7392+
create_graph
7393+
--------------
7394+
7395+
(1 row)
7396+
7397+
SELECT result, agtype('[1, 2, 3]') FROM cypher('issue_1303', $$ CREATE (u) RETURN u $$) AS (result agtype);
7398+
result | agtype
7399+
----------------------------------------------------------------+-----------
7400+
{"id": 281474976710657, "label": "", "properties": {}}::vertex | [1, 2, 3]
7401+
(1 row)
7402+
7403+
SELECT result, result2, pg_typeof(result2) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), agtype('[1, 2, 3]') AS result2;
7404+
result | result2 | pg_typeof
7405+
----------------------------------------------------------------+-----------+-----------
7406+
{"id": 281474976710657, "label": "", "properties": {}}::vertex | [1, 2, 3] | agtype
7407+
(1 row)
7408+
7409+
SELECT result, result2, pg_typeof(result2) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2;
7410+
result | result2 | pg_typeof
7411+
----------------------------------------------------------------+---------+-----------
7412+
{"id": 281474976710657, "label": "", "properties": {}}::vertex | 1 | text
7413+
(1 row)
7414+
7415+
SELECT result, result2, pg_typeof(result2), result3, pg_typeof(result3) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2, agtype(result) AS result3;
7416+
result | result2 | pg_typeof | result3 | pg_typeof
7417+
----------------------------------------------------------------+---------+-----------+----------------------------------------------------------------+-----------
7418+
{"id": 281474976710657, "label": "", "properties": {}}::vertex | 1 | text | {"id": 281474976710657, "label": "", "properties": {}}::vertex | agtype
7419+
(1 row)
7420+
7421+
SELECT result, result2, pg_typeof(result2), result3, pg_typeof(result3) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2, agtype(result2) AS result3;
7422+
result | result2 | pg_typeof | result3 | pg_typeof
7423+
----------------------------------------------------------------+---------+-----------+---------+-----------
7424+
{"id": 281474976710657, "label": "", "properties": {}}::vertex | 1 | text | 1 | agtype
7425+
(1 row)
7426+
7427+
-- Text OpExpr expression node types
7428+
SELECT * FROM agtype('[1, 2, 3]'::agtype || '[5, 6, 7]');
7429+
agtype
7430+
--------------------
7431+
[1, 2, 3, 5, 6, 7]
7432+
(1 row)
7433+
7434+
SELECT * FROM agtype('[1, 2, 3]'::agtype -> 2);
7435+
agtype
7436+
--------
7437+
3
7438+
(1 row)
7439+
7440+
SELECT * FROM agtype('{"a": 1, "b": 2}'::agtype -> 'a'::text);
7441+
agtype
7442+
--------
7443+
1
7444+
(1 row)
7445+
7446+
-- Text BoolExpr expression node types
7447+
SELECT * FROM bool(true AND false);
7448+
bool
7449+
------
7450+
f
7451+
(1 row)
7452+
73077453
--
73087454
-- Cleanup
73097455
--
@@ -7317,6 +7463,16 @@ NOTICE: graph "issue_1124" has been dropped
73177463

73187464
(1 row)
73197465

7466+
SELECT * FROM drop_graph('issue_1303', true);
7467+
NOTICE: drop cascades to 2 other objects
7468+
DETAIL: drop cascades to table issue_1303._ag_label_vertex
7469+
drop cascades to table issue_1303._ag_label_edge
7470+
NOTICE: graph "issue_1303" has been dropped
7471+
drop_graph
7472+
------------
7473+
7474+
(1 row)
7475+
73207476
SELECT * FROM drop_graph('graph_395', true);
73217477
NOTICE: drop cascades to 7 other objects
73227478
DETAIL: drop cascades to table graph_395._ag_label_vertex

‎regress/sql/expr.sql

+37
Original file line numberDiff line numberDiff line change
@@ -2986,10 +2986,47 @@ SELECT * FROM create_graph('issue_1124');
29862986
SELECT results, pg_typeof(user) FROM cypher('issue_1124', $$ CREATE (u) RETURN u $$) AS (results agtype), user;
29872987
SELECT results, pg_typeof(user) FROM cypher('issue_1124', $$ MATCH (u) RETURN u $$) AS (results agtype), user;
29882988

2989+
--
2990+
-- issue 1303: segmentation fault on queries like SELECT * FROM agtype(null);
2991+
--
2992+
2993+
-- Test Const and CoerceViaIO expression node types
2994+
SELECT * FROM agtype(null);
2995+
SELECT * FROM agtype('1');
2996+
SELECT * FROM agtype('[1, 2, 3]');
2997+
SELECT * FROM agtype('{"a": 1}');
2998+
SELECT * FROM agtype('{"id": 844424930131971, "label": "v", "properties": {"i": 1}}::vertex');
2999+
SELECT * FROM agtype('{"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge');
3000+
SELECT * FROM agtype('[{"id": 1125899906842625, "label": "v1", "properties": {"id": "initial"}}::vertex, {"id": 1407374883553282, "label": "e1", "end_id": 1125899906842626, "start_id": 1125899906842625, "properties": {}}::edge, {"id": 1125899906842626, "label": "v1", "properties": {"id": "middle"}}::vertex, {"id": 1407374883553281, "label": "e1", "end_id": 1125899906842627, "start_id": 1125899906842626, "properties": {}}::edge, {"id": 1125899906842627, "label": "v1", "properties": {"id": "end"}}::vertex]::path');
3001+
3002+
SELECT * FROM text(1);
3003+
SELECT * FROM text('1');
3004+
SELECT * FROM int4(1);
3005+
SELECT * FROM json('1');
3006+
SELECT * FROM jsonb('1');
3007+
SELECT * FROM bytea('1');
3008+
3009+
-- Test Var expression node types
3010+
SELECT create_graph('issue_1303');
3011+
SELECT result, agtype('[1, 2, 3]') FROM cypher('issue_1303', $$ CREATE (u) RETURN u $$) AS (result agtype);
3012+
SELECT result, result2, pg_typeof(result2) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), agtype('[1, 2, 3]') AS result2;
3013+
SELECT result, result2, pg_typeof(result2) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2;
3014+
SELECT result, result2, pg_typeof(result2), result3, pg_typeof(result3) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2, agtype(result) AS result3;
3015+
SELECT result, result2, pg_typeof(result2), result3, pg_typeof(result3) FROM cypher('issue_1303', $$ MATCH (u) RETURN u $$) AS (result agtype), text(1) AS result2, agtype(result2) AS result3;
3016+
3017+
-- Text OpExpr expression node types
3018+
SELECT * FROM agtype('[1, 2, 3]'::agtype || '[5, 6, 7]');
3019+
SELECT * FROM agtype('[1, 2, 3]'::agtype -> 2);
3020+
SELECT * FROM agtype('{"a": 1, "b": 2}'::agtype -> 'a'::text);
3021+
3022+
-- Text BoolExpr expression node types
3023+
SELECT * FROM bool(true AND false);
3024+
29893025
--
29903026
-- Cleanup
29913027
--
29923028
SELECT * FROM drop_graph('issue_1124', true);
3029+
SELECT * FROM drop_graph('issue_1303', true);
29933030
SELECT * FROM drop_graph('graph_395', true);
29943031
SELECT * FROM drop_graph('chained', true);
29953032
SELECT * FROM drop_graph('VLE', true);

‎src/backend/parser/cypher_analyze.c

+20-6
Original file line numberDiff line numberDiff line change
@@ -171,13 +171,20 @@ static bool convert_cypher_walker(Node *node, ParseState *pstate)
171171
* From PG -
172172
* SQLValueFunction - parameterless functions with special grammar
173173
* productions.
174+
* CoerceViaIO - represents a type coercion between two types whose textual
175+
* representations are compatible
176+
* Var - expression node representing a variable (ie, a table column)
177+
* OpExpr - expression node for an operator invocation
178+
* Const - constant value or expression node
179+
* BoolExpr - expression node for the basic Boolean operators AND, OR, NOT
174180
*
175181
* These are a special case that needs to be ignored.
176182
*
177-
* TODO: This likely needs to be done with XmlExpr types, and maybe
178-
* a few others too.
179183
*/
180-
if (IsA(funcexpr, SQLValueFunction))
184+
if (IsA(funcexpr, SQLValueFunction)
185+
|| IsA(funcexpr, CoerceViaIO)
186+
|| IsA(funcexpr, Var) || IsA(funcexpr, OpExpr)
187+
|| IsA(funcexpr, Const) || IsA(funcexpr, BoolExpr))
181188
{
182189
return false;
183190
}
@@ -315,13 +322,20 @@ static bool is_func_cypher(FuncExpr *funcexpr)
315322
* From PG -
316323
* SQLValueFunction - parameterless functions with special grammar
317324
* productions.
325+
* CoerceViaIO - represents a type coercion between two types whose textual
326+
* representations are compatible
327+
* Var - expression node representing a variable (ie, a table column)
328+
* OpExpr - expression node for an operator invocation
329+
* Const - constant value or expression node
330+
* BoolExpr - expression node for the basic Boolean operators AND, OR, NOT
318331
*
319332
* These are a special case that needs to be ignored.
320333
*
321-
* TODO: This likely needs to be done with XmlExpr types, and maybe
322-
* a few others too.
323334
*/
324-
if (IsA(funcexpr, SQLValueFunction))
335+
if (IsA(funcexpr, SQLValueFunction)
336+
|| IsA(funcexpr, CoerceViaIO)
337+
|| IsA(funcexpr, Var) || IsA(funcexpr, OpExpr)
338+
|| IsA(funcexpr, Const) || IsA(funcexpr, BoolExpr))
325339
{
326340
return false;
327341
}

0 commit comments

Comments
 (0)