[postgis-tickets] [PostGIS] #3392: ST_AsGeoJSON crashes backend

[PostGIS]

#3392: ST_AsGeoJSON crashes backend
---------------------+--------------------------------
 Reporter:  bhodgen  |      Owner:  pramsey
     Type:  defect   |     Status:  new
 Priority:  medium   |  Milestone:  PostGIS PostgreSQL
Component:  postgis  |    Version:  2.1.x
 Keywords:           |
---------------------+--------------------------------
 '''Version Info'''

 Ubuntu Server: 14.04.3 LTS 64bit

 POSTGIS="2.1.8 r13780" GEOS="3.4.2-CAPI-1.8.2 r3921" PROJ="Rel. 4.8.0, 6
 March 2012" GDAL="GDAL 1.10.1, released 2013/08/26" LIBXML="2.9.1"
 LIBJSON="UNKNOWN" TOPOLOGY RASTER

 PostgreSQL 9.4.5 on x86_64-unknown-linux-gnu, compiled by gcc (Ubuntu
 4.8.2-19ubuntu1) 4.8.2, 64-bit

 '''Issue'''

 We have observed this issue on three separate VM's running in HyperV, and
 one instance in VMWare Fusion 8 I setup to verify the problem. The issue
 is triggered when using a plpgsql function that has a search_path set, and
 with the ST_AsGeoJSON function called on an empty geometry.

 This is pretty weird edge case and we are able to work around it, but I
 thought I would file a ticket in case this behavior is indicative of a
 larger issue somewhere in the code base.

 We found the issue in a function we use to calculate the area of a
 geometry, and originally thought it was an issue with our function.
 However, after further research it seems like any function that explicitly
 alters set_path will exhibit the problem. I used the following function to
 replicate the issue.
 {{{#!sql
 CREATE SCHEMA common;

 CREATE OR REPLACE FUNCTION common.sad_panda(geom geometry)
     RETURNS integer AS
 $$
 BEGIN
     RETURN 1;
 END;
 $$
 LANGUAGE 'plpgsql' IMMUTABLE SECURITY DEFINER;
 ALTER FUNCTION common.sad_panda(geom geometry) SET search_path = common;
 }}}

 After you have created the schema and function above, running the
 following query will crash PostgreSQL. It doesn't matter if you use a CTE,
 or select the data from a table, as long as the geometry is empty it will
 crash the server.
 {{{#!sql
 WITH empty_geoms AS (
    SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
 )
 SELECT common.sad_panda(geom),st_asgeojson(geom)
 FROM empty_geoms;
 }}}

 '''Other Info'''

 Changing the order of the selectors resolves the issue, as the following
 query will work without any problems.

 {{{#!sql
 WITH empty_geoms AS (
    SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
 )
 SELECT st_asgeojson(geom), common.sad_panda(geom)
 FROM empty_geoms;
 }}}

 Removing the search_path from the function also resolves the issue. We
 haven't tried creating the function in the public schema, but setting the
 search_path to public (the default when creating a function I believe)
 still exhibits the problem.
 {{{#!sql
 CREATE SCHEMA common;

 CREATE OR REPLACE FUNCTION common.sad_panda(geom geometry)
     RETURNS integer AS
 $$
 BEGIN
     RETURN 1;
 END;
 $$
 LANGUAGE 'plpgsql' IMMUTABLE SECURITY DEFINER;
 --ALTER FUNCTION common.sad_panda(geom geometry) SET search_path = common;
 }}}

 If you run the following query right after crashing the database...
 {{{#!sql
 WITH empty_geoms AS (
    SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
 )
 SELECT st_asgeojson(geom),common.sad_panda(geom),st_asgeojson(geom)
 FROM empty_geoms;
 }}}
 you get the following error message.
 {{{
 ERROR:  lwgeom_free called with unknown type (105) Invalid type

 ********** Error **********

 ERROR: lwgeom_free called with unknown type (105) Invalid type
 SQL state: XX000
 }}}

--
Ticket URL: <http://trac.osgeo.org/postgis/ticket/3392>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.