Fix list-manipulation bug in WITH RECURSIVE processing.
authorTom Lane <tgl@sss.pgh.pa.us>
Fri, 26 Feb 2021 01:47:32 +0000 (20:47 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Fri, 26 Feb 2021 01:47:32 +0000 (20:47 -0500)
commit80ca8464fe02296c8efefd53746e6d6a3f456d1e
tree0351dbf4d9d7b71d9754e04eb6d88be0eeb3924c
parent2376361839091b0dcdcc0b77f938b809b5f21646
Fix list-manipulation bug in WITH RECURSIVE processing.

makeDependencyGraphWalker and checkWellFormedRecursionWalker
thought they could hold onto a pointer to a list's first
cons cell while the list was modified by recursive calls.
That was okay when the cons cell was actually separately
palloc'd ... but since commit 1cff1b95a, it's quite unsafe,
leading to core dumps or incorrect complaints of faulty
WITH nesting.

In the field this'd require at least a seven-deep WITH nest
to cause an issue, but enabling DEBUG_LIST_MEMORY_USAGE
allows the bug to be seen with lesser nesting depths.

Per bug #16801 from Alexander Lakhin.  Back-patch to v13.

Michael Paquier and Tom Lane

Discussion: https://postgr.es/m/16801-393c7922143eaa4d@postgresql.org
src/backend/parser/parse_cte.c
src/test/regress/expected/with.out
src/test/regress/sql/with.sql