Skip to content

Do not read the schema argument of install_extension() when it is not passed - #325

Open
devrimgunduz wants to merge 1 commit into
aws:mainfrom
devrimgunduz:fix-install-extension-nargs
Open

devrimgunduz wants to merge 1 commit into
aws:mainfrom
devrimgunduz:fix-install-extension-nargs

Conversation

@devrimgunduz

Copy link
Copy Markdown
Contributor

pgtle.install_extension() got the schema argument in 1.5.0. When the SQL objects of pg_tle are still at an older version, for example after the shared library is upgraded but ALTER EXTENSION pg_tle UPDATE has not been run yet, the function is called with five arguments. pg_tle_install_extension() always looked at the sixth one, which reads past the arguments that were passed. The result depends on what happens to be in memory there.

The pg_tle_extension_schema regression test does exactly this: it runs CREATE EXTENSION pg_tle VERSION '1.4.0' and then calls install_extension(). With 1.5.3 on Rocky Linux 8 and PostgreSQL 16.15 (GCC 8.5), the backend crashes with a segfault every time:

LOG:  server process (PID 321) was terminated by signal 11: Segmentation fault
DETAIL:  Failed process was running: SELECT pgtle.install_extension('my_tle', '1.0', 'My TLE', ...

and pg_tle_extension_schema, pg_tle_datatype, pg_tle_requires and pg_tle_api fail, the last three because of the crash recovery. The same test passes on PostgreSQL 14, 15, 17 and 18 on Rocky Linux 8, and on Fedora 44 with PostgreSQL 16.

This checks PG_NARGS() before looking at the schema argument. requires is in every version of the SQL function, so it does not need the check.

With this change, the regression and TAP tests pass on Rocky Linux 8 (PostgreSQL 14 to 18), Fedora 44 (15 to 19) and Rocky Linux 9 (19).

… passed

pgtle.install_extension() got the schema argument in 1.5.0. When the SQL
objects of pg_tle are still at an older version (for example after the
shared library is upgraded but ALTER EXTENSION pg_tle UPDATE has not been
run yet), the function is called with five arguments, but
pg_tle_install_extension() always looked at the sixth one. That reads past
the arguments that were passed, and crashes the backend on some builds.

The pg_tle_extension_schema regression test does exactly this: it creates
pg_tle at version 1.4.0 and calls install_extension(). It crashed with a
segfault on Rocky Linux 8 with PostgreSQL 16, every time.

Check PG_NARGS() before looking at the schema argument.
postgres-mirror pushed a commit to pgdg-packaging/pgdg-rpms that referenced this pull request Oct 9, 2026
…aws/pg_tle/releases/tag/v1.5.3 . Add PostgreSQL 19 support. Add a patch to fix a backend crash in pgtle.install_extension() when pg_tle's SQL objects are older than 1.5.0, sent upstream as aws/pg_tle#325 . Also add %check (disabled by default).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant