Re: BUG #15668: Server crash in transformPartitionRangeBounds

Hi,

(cc'ing -hackers and Peter E)

On Tue, Mar 5, 2019 at 8:02 PM PG Bug reporting form
<noreply@postgresql.org> wrote:
>
> The following bug has been logged on the website:
>
> Bug reference:      15668
> Logged by:          Alexander Lakhin
> Email address:      exclusion@gmail.com
> PostgreSQL version: Unsupported/Unknown
> Operating system:   Ubuntu 18.04
> Description:
>
> The following query:
> CREATE TABLE range_parted (a int) PARTITION BY RANGE (a);
> CREATE TABLE rp_part PARTITION OF range_parted FOR VALUES FROM
> (unknown.unknown) TO (1);
>
> crashes server (on the master branch) with the stack trace:
> Core was generated by `postgres: law regression [local] CREATE TABLE
>                         '.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x0000560ab19ea0bc in transformPartitionRangeBounds
> (pstate=pstate@entry=0x560ab3290da8, blist=<optimized out>,
>     parent=parent@entry=0x7f7846a6bea8) at parse_utilcmd.c:3754
> 3754                            if (strcmp("minvalue", cname) == 0)

Thanks for the report.  Seems to be a bug of the following commit in
HEAD, of which I was one of the authors:

commit 7c079d7417a8f2d4bf5144732e2f85117db9214f
Author: Peter Eisentraut <peter@eisentraut.org>
Date:   Fri Jan 25 11:27:59 2019 +0100

    Allow generalized expression syntax for partition bounds

That seems to be caused by some over-optimistic coding in
transformPartitionRangeBounds.  Following will crash too.

CREATE TABLE rp_part PARTITION OF range_parted FOR VALUES FROM
(a.a.a.a.a.a.a.a.a.a.a.a) TO (1);

If I try the list partitioning syntax, it doesn't crash but gives the
following error:

create table lparted1 partition of lparted for values in (a.a.a.a.a.a);
ERROR:  improper qualified name (too many dotted names): a.a.a.a.a.a
LINE 1: ...able lparted1 partition of lparted for values in (a.a.a.a.a....
                                                             ^
Maybe we should error out as follows in
transformPartitionRangeBounds(), although that means we'll get
different error message than when using list partitioning syntax:

@@ -3749,6 +3749,12 @@ transformPartitionRangeBounds(ParseState
*pstate, List *blist,
            if (list_length(cref->fields) == 1 &&
                IsA(linitial(cref->fields), String))
                cname = strVal(linitial(cref->fields));
+           else
+               ereport(ERROR,
+                       (errcode(ERRCODE_INVALID_OBJECT_DEFINITION),
+                        errmsg("invalid expression for range bound"),
+                        parser_errposition(pstate,
+                                           exprLocation((Node *) expr))));

            Assert(cname != NULL);
            if (strcmp("minvalue", cname) == 0)

Thanks,
Amit