[postgis-devel] [PostGIS] #1832: Crash when updating GIST index on geography column

[PostGIS]

#1832: Crash when updating GIST index on geography column
----------------------------------+-----------------------------------------
 Reporter:  raduilie              |       Owner:  pramsey      
     Type:  defect                |      Status:  new          
 Priority:  high                  |   Milestone:  PostGIS 1.5.4
Component:  postgis               |     Version:  1.5.X        
 Keywords:  crash gist geography  |  
----------------------------------+-----------------------------------------
 PostGIS 1.5.4 crashes when trying to update a GIST index on a geography
 column. The stack trace is:

 #0  gidx_is_unknown (fcinfo=0xbff3a0ec) at geography_gist.c:172
 #1  gidx_union_volume (fcinfo=0xbff3a0ec) at geography_gist.c:270
 #2  geography_gist_penalty (fcinfo=0xbff3a0ec) at geography_gist.c:972
 #3  0x0833e5d2 in FunctionCall3Coll (flinfo=0xbff3b578, collation=100,
 arg1=3220416064, arg2=3220415392, arg3=3220415272) at fmgr.c:1344
 #4  0x08096e25 in gistpenalty (giststate=0x864c318, attno=0,
 orig=0xbff3a640, isNullOrig=1 '\001', add=0xbff3a3a0, isNullAdd=0 '\000')
 at gistutil.c:532
 #5  0x080973cc in gistchoose (r=0x953ae988, p=0x96e13f80 "\005",
 it=0x864c310, giststate=0xbff3a778) at gistutil.c:409
 #6  0x080961c3 in gistdoinsert (r=0x953ae988, itup=0x864c310,
 freespace=<value optimized out>, giststate=0xbff3a778) at gist.c:715
 #7  0x0809694d in gistinsert (fcinfo=0xbff3c42c) at gist.c:277
 #8  0x0833e349 in FunctionCall6Coll (flinfo=0x8581968, collation=0,
 arg1=2503666056, arg2=3220424396, arg3=3220424524, arg4=140788948,
 arg5=2504032136, arg6=0) at fmgr.c:1432
 #9  0x080af105 in index_insert (indexRelation=0x953ae988,
 values=0xbff3c6cc, isnull=0xbff3c74c "", heap_t_ctid=0x86444d4,
 heapRelation=0x95407f88, checkUnique=UNIQUE_CHECK_NO) at indexam.c:215
 #10 0x081b97e7 in ExecInsertIndexTuples (slot=0x8644488,
 tupleid=0x86444d4, estate=0x8644210) at execUtils.c:1085
 #11 0x081c528f in ExecInsert (node=0x86442c8) at nodeModifyTable.c:247
 #12 ExecModifyTable (node=0x86442c8) at nodeModifyTable.c:847
 #13 0x081b0474 in ExecProcNode (node=0x86442c8) at execProcnode.c:371
 #14 0x081af2e1 in ExecutePlan (queryDesc=0x8580d50,
 direction=ForwardScanDirection, count=0) at execMain.c:1439
 #15 standard_ExecutorRun (queryDesc=0x8580d50,
 direction=ForwardScanDirection, count=0) at execMain.c:313
 #16 0x0827e773 in ProcessQuery (plan=0x859cb18,
     sourceText=0x8609488 "BEGIN; INSERT INTO test_crash VALUES(293, 'NAME
 293', ST_GeometryFromText('POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))',
 4326)::geography); COMMIT;", params=<value optimized out>,
     dest=0x859cb88, completionTag=0xbff3ca4a "") at pquery.c:187
 #17 0x0827e989 in PortalRunMulti (portal=0x857ed48, isTopLevel=<value
 optimized out>, dest=0x859cb88, altdest=0x859cb88,
 completionTag=0xbff3ca4a "") at pquery.c:1276
 #18 0x0827f458 in PortalRun (portal=0x857ed48, count=2147483647,
 isTopLevel=0 '\000', dest=0x859cb88, altdest=0x859cb88,
 completionTag=0xbff3ca4a "") at pquery.c:813
 #19 0x0827bd72 in exec_simple_query (
     query_string=0x8609488 "BEGIN; INSERT INTO test_crash VALUES(293,
 'NAME 293', ST_GeometryFromText('POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))',
 4326)::geography); COMMIT;") at postgres.c:1018
 #20 0x0827c670 in PostgresMain (argc=2, argv=0x8579d70, username=0x8579cd0
 "postgres") at postgres.c:3926
 #21 0x0823d0f9 in ServerLoop () at postmaster.c:3606
 #22 0x0823df29 in PostmasterMain (argc=3, argv=0x8577af0) at
 postmaster.c:1116
 #23 0x081df940 in main (argc=3, argv=0x3f7fec09) at main.c:199

 GDB says that variable a is NULL at frame 1:

 (gdb) frame 1
 #1  gidx_union_volume (fcinfo=0xbff3a0ec) at geography_gist.c:270
 270     in geography_gist.c
 (gdb) p a
 $1 = (GIDX *) 0x0
 (gdb) p b
 $2 = (GIDX *) 0x864c318

 Which makes it clear why gidx_is_unknown is crashing.

 I think that the checks in gidx_union_volume are in the wrong order. It
 should first check that a or b is NULL and then call gidx_is_unknown. Or
 add some check to gidx_is_unknown to check for NULL parameter.

 I am attaching a couple of scripts: create.sql will create a test
 database, load PostGIS in it and create a very simple test table. The
 script named "test" will insert rows in that table until PostgreSQL
 crashes.

-- 
Ticket URL: <http://trac.osgeo.org/postgis/ticket/1832>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.