[PostGIS] #6148: pgis_asmvt_transfn() crashes on NULL argument

PostGIS trac at osgeo.org
Tue Oct 20 06:26:59 PDT 2026


#6148: pgis_asmvt_transfn() crashes on NULL argument
--------------------------+---------------------------
 Reporter:  alexanderlaw  |      Owner:  pramsey
     Type:  defect        |     Status:  new
 Priority:  medium        |  Milestone:  PostGIS 3.6.5
Component:  postgis       |    Version:  master
 Keywords:                |
--------------------------+---------------------------
 The following query:
 {{{
 SELECT ST_AsMVT(NULL::spatial_ref_sys);
 }}}

 or
 {{{
 SELECT ST_AsMVT(s) FROM (SELECT 1) x LEFT JOIN spatial_ref_sys s ON false;
 }}}

 triggers a server crash:
 {{{
 server closed the connection unexpectedly
         This probably means the server terminated abnormally
         before or while processing the request.
 }}}

 {{{
 Core was generated by `postgres: law pgis_test [local] SELECT '.
 Program terminated with signal SIGSEGV, Segmentation fault.
 #0  0x00005cb4d119d9ea in VARATT_IS_EXTENDED (PTR=0x0) at
 ../../../../src/include/varatt.h:412
 412             return !VARATT_IS_4B_U(PTR);
 (gdb) bt
 #0  0x00005cb4d119d9ea in VARATT_IS_EXTENDED (PTR=0x0) at
 ../../../../src/include/varatt.h:412
 #1  0x00005cb4d11a203f in pg_detoast_datum (datum=0x0) at fmgr.c:1800
 #2  0x000072bc1a734e8c in pgis_asmvt_transfn (fcinfo=0x5cb4d6e6f4a0) at
 /tmp/pg/include/postgresql/server/postgres.h:334
 #3  0x00005cb4d0c5a1b6 in ExecAggPlainTransByVal (aggstate=0x5cb4d6e03198,
 pertrans=0x5cb4d6e04b00, pergroup=0x5cb4d6e04d28,
 aggcontext=0x5cb4d6e03720,
     setno=0) at execExprInterp.c:5932
 ...
 #18 0x00005cb4d0f7fff8 in exec_simple_query (query_string=0x5cb4d6cfd030
 "SELECT ST_AsMVT(NULL::spatial_ref_sys);") at postgres.c:1290
 }}}

 This function doesn't check if argument 1 is NULL:

 {{{
 PG_FUNCTION_INFO_V1(pgis_asmvt_transfn);
 Datum pgis_asmvt_transfn(PG_FUNCTION_ARGS)
 {
 ...
         ctx->row = PG_GETARG_HEAPTUPLEHEADER(1);
 ...

 }}}

 similar to [https://trac.osgeo.org/postgis/ticket/6147 #6147]

 SELECT postgis_full_version()

 {{{
 POSTGIS="3.7.0rc3 3.7.0rc1-119-gdcc888996" [EXTENSION] PGSQL="190"
 GEOS="3.12.1-CAPI-1.18.1" PROJ="9.4.0 NETWORK_ENABLED=OFF
 URL_ENDPOINT=https://cdn.proj.org USER_WRITABLE_DIRECTORY=...
 DATABASE_PATH=/usr/share/proj/proj.db" (compiled against PROJ 9.4.0)
 LIBXML="2.9.14" LIBJSON="0.17" LIBPROTOBUF="1.4.1" WAGYU="0.5.0
 (Internal)"
 }}}
-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/6148>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.


More information about the postgis-tickets mailing list