#5350 closed defect (fixed)

ST_AsSVG crashes on geometry collection with an empty point

Reported by: robe Owned by: robe
Priority: blocker Milestone: PostGIS 3.4.0
Component: postgis Version: 3.3.x
Keywords: Cc:

Description (last modified by robe)

  SELECT  ST_AsSVG(ST_GeomFromText('GEOMETRYCOLLECTION (POINT EMPTY, LINESTRING (0 0, 1 1))',4326), 3, 5 )

Inspired by https://github.com/libgeos/geos/pull/831

I stuffed that nasty geometry into the garden grinder and it crashed ST_ASSVG

Change History (4)

comment:1 by robe, 14 months ago

Description: modified (diff)
Owner: changed from pramsey to robe

comment:2 by robe, 14 months ago

stack trace looks like

0x0000000063f6c095 in assvg_point (sb=sb@entry=0x51eea10,
    circle=circle@entry=1, precision=precision@entry=5, point=<optimized out>)
    at lwout_svg.c:133
133             lwprint_double(pt->x, precision, sx);
(gdb) bt
#0  0x0000000063f6c095 in assvg_point (sb=sb@entry=0x51eea10,
    circle=circle@entry=1, precision=precision@entry=5, point=<optimized out>)
    at lwout_svg.c:133
#1  0x0000000063f6cc82 in assvg_geom (precision=5, relative=1,
    geom=<optimized out>, sb=0x51eea10) at lwout_svg.c:252
#2  assvg_collection (col=0x8557668, col=0x8557668, precision=5, relative=1,
    sb=0x51eea10) at lwout_svg.c:237
#3  lwgeom_to_svg (geom=0x8557668, precision=5, relative=1) at lwout_svg.c:325
#4  0x000000000061026f in ExecInterpExpr (state=0x8559888,
    econtext=0x8559ad8, isnull=<optimized out>) at execExprInterp.c:752
#5  0x0000000000710fe1 in ExecEvalExprSwitchContext (isNull=0x51eeb7c,
    econtext=<optimized out>, state=0x8559888)
    at ../../../../src/include/executor/executor.h:344
#6  evaluate_expr (expr=<optimized out>, result_type=result_type@entry=25,
    result_typmod=result_typmod@entry=-1,
    result_collation=result_collation@entry=100) at clauses.c:4845
#7  0x0000000000712a58 in evaluate_function (context=0x51ef020,
    func_tuple=0x8620190, funcvariadic=false, args=0x855fcc0, input_collid=0,
    result_collid=100, result_typmod=-1, result_type=25, funcid=20542)
    at clauses.c:4347
#8  simplify_function (funcid=20542, result_type=25, result_typmod=-1,
    result_collid=result_collid@entry=100, input_collid=input_collid@entry=0,
    args_p=args_p@entry=0x51eed60, funcvariadic=funcvariadic@entry=false,
    process_args=process_args@entry=true,
    allow_non_const=allow_non_const@entry=true,
    context=context@entry=0x51ef020) at clauses.c:3930
#9  0x000000000071113b in eval_const_expressions_mutator (node=0x7b8f280,
    context=0x51ef020) at clauses.c:2466
#10 0x000000000068be24 in expression_tree_mutator_impl (
    node=node@entry=0x7b8f2d0,
    mutator=mutator@entry=0x711080 <eval_const_expressions_mutator>,
    context=context@entry=0x51ef020) at nodeFuncs.c:3269
#11 0x00000000007111a6 in eval_const_expressions_mutator (node=0x7b8f2d0,
    context=0x51ef020) at clauses.c:3549
#12 0x000000000068c054 in expression_tree_mutator_impl (
    node=node@entry=0x7b8f320,
    mutator=mutator@entry=0x711080 <eval_const_expressions_mutator>,
    context=context@entry=0x51ef020) at nodeFuncs.c:3136
#13 0x00000000007111a6 in eval_const_expressions_mutator (node=0x7b8f320,
    context=context@entry=0x51ef020) at clauses.c:3549
#14 0x00000000007128c4 in eval_const_expressions (root=root@entry=0x855f5c8,
    node=<optimized out>) at clauses.c:2146
#15 0x00000000006f3f8e in preprocess_expression (root=root@entry=0x855f5c8,
    expr=<optimized out>, kind=kind@entry=1) at planner.c:1145
#16 0x00000000006fcc37 in subquery_planner (glob=glob@entry=0x7b8e780,
    parse=<optimized out>, parse@entry=0x7b8e890,
    parent_root=parent_root@entry=0x0, hasRecursion=hasRecursion@entry=false,
    tuple_fraction=tuple_fraction@entry=0) at planner.c:811
#17 0x00000000006fd48f in standard_planner (parse=0x7b8e890,
    query_string=<optimized out>, cursorOptions=2048,
    boundParams=<optimized out>) at planner.c:411
#18 0x00000000007e33fa in pg_plan_query (querytree=0x7b8e890,
    query_string=0x7b8d798 " SELECT  ST_AsSVG(ST_GeomFromText('GEOMETRYCOLLECTION (POINT EMPTY, LINESTRING (0 0, 1 1))',4326), 3, 5 )", cursorOptions=2048,
    boundParams=0x0) at postgres.c:870
#19 0x00000000007e3501 in pg_plan_queries (querytrees=0x7b8f3f0,
    query_string=query_string@entry=0x7b8d798 " SELECT  ST_AsSVG(ST_GeomFromText('GEOMETRYCOLLECTION (POINT EMPTY, LINESTRING (0 0, 1 1))',4326), 3, 5 )",
    cursorOptions=cursorOptions@entry=2048, boundParams=boundParams@entry=0x0)
    at postgres.c:962
#20 0x00000000007e3895 in exec_simple_query (
    query_string=0x7b8d798 " SELECT  ST_AsSVG(ST_GeomFromText('GEOMETRYCOLLECTION (POINT EMPTY, LINESTRING (0 0, 1 1))',4326), 3, 5 )") at postgres.c:1159
#21 0x00000000007e6c6e in PostgresMain (dbname=0x5f76eb0 "postgres",
    username=0x5f78d68 "postgres") at postgres.c:4572
#22 0x00000000007489e2 in BackendRun (port=0x51ef7c0, port=0x51ef7c0)
    at postmaster.c:4461
#23 SubPostmasterMain (argc=argc@entry=3, argv=argv@entry=0x5f76ca0)
    at postmaster.c:4965
#24 0x00000000009a2ea9 in main (argc=3, argv=0x5f76ca0) at main.c:192

comment:3 by Regina Obe <lr@…>, 14 months ago

In a3894467/git:

Crash on ST_AsSVG with empties
References #5350 for PostGIS 3.4.0

comment:4 by robe, 14 months ago

Milestone: PostGIS 3.0.9PostGIS 3.4.0
Resolution: fixed
Status: newclosed

I thought I'd need to backport this change, but it looks like stable-3.3 is okay and by extension I assume the others are too.

The output in 3.3 is

x="2.94485e-317" y="-1.14e-321";M 0 0 l 1 -1

I think the crash was introduced in master with the change of using string_buffer. In master, I went with just skipping empties, so output is

M 0 0 l 1 -1
Note: See TracTickets for help on using tickets.