[postgis-tickets] [PostGIS] #4466: UBSAN in _postgis_gserialized_stats

[PostGIS]

#4466: UBSAN in _postgis_gserialized_stats
------------------------+----------------------------
 Reporter:  Algunenano  |      Owner:  pramsey
     Type:  defect      |     Status:  new
 Priority:  medium      |  Milestone:  PostGIS 2.3.10
Component:  postgis     |    Version:  2.3.x
 Keywords:              |
------------------------+----------------------------
 _postgis_gserialized_stats is reading 4 parameters but only 3 are ever
 passed.

 Dump:
 {{{
 #0  0x00007fae2e0f94ee in _postgis_gserialized_stats
 (fcinfo=0x5612f5fa1090) at gserialized_estimate.c:2087
 2087            if ( ! PG_ARGISNULL(3) )
 (gdb) bt
 #0  0x00007fae2e0f94ee in _postgis_gserialized_stats
 (fcinfo=0x5612f5fa1090) at gserialized_estimate.c:2087
 #1  0x00005612f3d23b13 in ExecInterpExpr (state=0x5612f5fa0fa8,
 econtext=0x5612f5fa0c98, isnull=0x7ffe886e4faf) at execExpr
 #2  0x00005612f3d5ea54 in ExecEvalExprSwitchContext (state=0x5612f5fa0fa8,
 econtext=0x5612f5fa0c98, isNull=0x7ed43954744d00
     at ../../../src/include/executor/executor.h:307
 #3  ExecProject (projInfo=0x5612f5fa0fa0) at
 ../../../src/include/executor/executor.h:341
 #4  ExecResult (pstate=<optimized out>) at nodeResult.c:136
 #5  0x00005612f3d2c3bc in ExecProcNode (node=<optimized out>) at
 ../../../src/include/executor/executor.h:239
 #6  ExecutePlan (estate=<optimized out>, planstate=0x5612f5fa0b80,
 operation=<optimized out>, numberTuples=<optimized out>,
     direction=<optimized out>, dest=0x5612f5fafaa8,
 use_parallel_mode=<optimized out>, sendTuples=<optimized out>,
     execute_once=<optimized out>) at execMain.c:1648
 #7  standard_ExecutorRun (queryDesc=<optimized out>, direction=<optimized
 out>, count=0, execute_once=<optimized out>) at e
 #8  0x00005612f3ed918b in PortalRunSelect (portal=0x5612f5f2bc68,
 forward=<optimized out>, count=0, dest=<optimized out>) a
 #9  0x00005612f3ed8c7a in PortalRun (portal=0x5612f5f2bc68,
 count=9223372036854775807, isTopLevel=<optimized out>,
     run_once=<optimized out>, dest=0x5612f5fafaa8, altdest=0x5612f5fafaa8,
 completionTag=0x7ffe886e5240 "") at pquery.c:770
 #10 0x00005612f3ed78ba in exec_simple_query (query_string=0x5612f5ec2408
 "select _postgis_stats('no_stats','g');") at postg
 #11 0x00005612f3ed50d7 in PostgresMain (argc=<optimized out>,
 argv=<optimized out>, dbname=<optimized out>, username=<optim
     at postgres.c:4245
 }}}

-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/4466>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.