database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-04 20:11:56 +03:00
Code Activity

pg_stat_statements: Fix handling of duplicate constant locations

Browse Source 
Two or more constants can have the same location.  We handled this
correctly for non squashed constants, but failed to do it if squashed
(resulting in out-of-bounds memory access), because the code structure
became broken by commit 0f65f3eec4: we failed to update 'last_loc'
correctly when skipping these squashed constants.

The simplest fix seems to be to get rid of 'last_loc' altogether -- in
hindsight, it's quite pointless.  Also, when ignoring a constant because
of this, make sure to fulfill fill_in_constant_lengths's duty of setting
its length to -1.

Lastly, we can use == instead of <= because the locations have been
sorted beforehand, so the < case cannot arise.

Co-authored-by: Sami Imseih <samimseih@gmail.com>
Co-authored-by: Dmitry Dolgov <9erthalion6@gmail.com>
Reported-by: Konstantin Knizhnik <knizhnik@garret.ru>
Backpatch-through: 18
Discussion: https://www.postgresql.org/message-id/2b91e358-0d99-43f7-be44-d2d4dbce37b3%40garret.ru
This commit is contained in:
Álvaro Herrera
2025-10-29 12:35:02 +01:00
parent a92bbffbc3
commit b1635c1666
3 changed files with 123 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
contrib/pg_stat_statements/pg_stat_statements.c
View File

@@ -2915,9 +2915,8 @@ generate_normalized_query(JumbleState *jstate, const char *query,
* have originated from within the authoritative parser, this should not be
* a problem.
*
* Duplicate constant pointers are possible, and will have their lengths
* marked as '-1', so that they are later ignored. (Actually, we assume the
* lengths were initialized as -1 to start with, and don't change them here.)
* Multiple constants can have the same location. We reset lengths of those
* past the first to -1 so that they can later be ignored.
*
* If query_loc > 0, then "query" has been advanced by that much compared to
* the original string start, so we need to translate the provided locations
@@ -2937,8 +2936,6 @@ fill_in_constant_lengths(JumbleState *jstate, const char *query,
core_yy_extra_type yyextra;
core_YYSTYPE yylval;
YYLTYPE yylloc;
int last_loc = -1;
int i;
/*
* Sort the records by location so that we can process them in order while
@@ -2959,23 +2956,29 @@ fill_in_constant_lengths(JumbleState *jstate, const char *query,
yyextra.escape_string_warning = false;
/* Search for each constant, in sequence */
for (i = 0; i < jstate->clocations_count; i++)
for (int i = 0; i < jstate->clocations_count; i++)
{
int loc = locs[i].location;
int loc;
int tok;
/* Adjust recorded location if we're dealing with partial string */
loc -= query_loc;
Assert(loc >= 0);
/* Ignore constants after the first one in the same location */
if (i > 0 && locs[i].location == locs[i - 1].location)
{
locs[i].length = -1;
continue;
}
if (locs[i].squashed)
continue; /* squashable list, ignore */
if (loc <= last_loc)
continue; /* Duplicate constant, ignore */
/* Adjust recorded location if we're dealing with partial string */
loc = locs[i].location - query_loc;
Assert(loc >= 0);
/* Lex tokens until we find the desired constant */
/*
* We have a valid location for a constant that's not a dupe. Lex
* tokens until we find the desired constant.
*/
for (;;)
{
tok = core_yylex(&yylval, &yylloc, yyscanner);
@@ -3021,8 +3024,6 @@ fill_in_constant_lengths(JumbleState *jstate, const char *query,
/* If we hit end-of-string, give up, leaving remaining lengths -1 */
if (tok == 0)
break;
last_loc = loc;
}
scanner_finish(yyscanner);