Opened 3 years ago

Closed 3 years ago

Last modified 21 months ago

#4017 closed defect (fixed)

lwgeom lexer memory corruption

Reported by: petere Owned by: strk
Priority: high Milestone: PostGIS 2.5.0
Component: liblwgeom Version: master
Keywords: Cc:

Description

We have experienced frequent crashes in PostGIS, with backtraces pointing to memory corruption in the lwgeom lexer. I believe the attached patch fixes the problem. We have had it running for about a week without crashes, where before, they were quite frequent.

The problem is that if a query is aborted while the lexer is running (e.g., statement timeout), the memory belonging to the internal lexer state is cleaned up by PostgreSQL, but the flex code thinks it's still there, so it will crash the next time the lexer runs. The fix is to reinitialize the flex globals before each run. (The same problem once existed in the core PostgreSQL code.)

The problem was observed in version 2.2, but the same code exists in trunk as well. I suggest the fix could be backpatched.

(You should regenerated the .c files using your preferred flex version.)

Attachments (1)

0001-Initialize-lwgeom-lexer-on-each-run.patch (19.2 KB) - added by petere 3 years ago.

Download all attachments as: .zip

Change History (13)

comment:1 Changed 3 years ago by pramsey

In 16422:

Fix memory corruption in case where lexer is interrupted mid-process
References #4017

comment:2 Changed 3 years ago by pramsey

In 16423:

Add re-generated files, a little after the lexer/parser
so hopefully make stops harassing us for a while
References #4017

comment:3 Changed 3 years ago by pramsey

In 16424:

Fix memory corruption in case where lexer is interrupted mid-process
References #4017
For 2.4 branch

comment:4 Changed 3 years ago by pramsey

In 16425:

Update lexer generated file
References #4017

comment:5 Changed 3 years ago by pramsey

In 16426:

Fix memory corruption in case where lexer is interrupted mid-process
References #4017
For 2.3

comment:6 Changed 3 years ago by pramsey

In 16428:

Fix memory corruption in case where lexer is interrupted mid-process
References #4017
For 2.2

comment:7 Changed 3 years ago by pramsey

Resolution: fixed
Status: newclosed

Thanks for the fix!

comment:8 Changed 21 months ago by pramsey

In 17234:

Add lex initialization
References #4017

comment:9 Changed 21 months ago by pramsey

In 17236:

Add lexer initialization
References #4017

comment:10 Changed 21 months ago by pramsey

In 17238:

Add lexer initialization
References #4017

comment:11 Changed 21 months ago by pramsey

In 17240:

Add initialization to lexer
References #4017

comment:12 Changed 21 months ago by pramsey

In 17242:

Add initializer to lexer
References #4017

Note: See TracTickets for help on using tickets.