malformed 'hive.operation' input string cause postgres client backend crash and postgres server restart
On the HAF database execute a select statement with malformed operation binary data (I changed the last 2 characters from 00 to AA):
SELECT '\x09102700000000000003535445454d000005737465656d076b65666164657801000000000103a78888f1cd1f039e63ef93314fc1fb196cc38d5b2090c8df49b806eeda4f3e350100010000000001031c0e33a27bcec921d6a9c3caf2e1ce4052d55bcd6a684372e90690d9c232c9c70100010000000001036da5bc9de6ff2110751f32c1919704a5116adeee0b2b7f28df244fca847ba559010003f74879a44d3fe215232098bf428d6412ff22051313e7132df1f06ed840aae81bAA'::hive.operation;
it will crash a client backend and then Postgres server will restart:
2023-09-19 05:42:49.072 UTC [19284] LOG: server process (PID 19307) was terminated by signal 11: Segmentation fault
2023-09-19 05:42:49.072 UTC [19284] DETAIL: Failed process was running: SELECT '\x09102700000000000003535445454d000005737465656d076b65666164657801000000000103a78888f1cd1f039e63ef93314fc1fb196cc38d5b2090c8df49b806eeda4f3e350100010000000001031c0e33a27bcec921d6a9c3caf2e1ce4052d55bcd6a684372e90690d9c232c9c70100010000000001036da5bc9de6ff2110751f32c1919704a5116adeee0b2b7f28df244fca847ba559010003f74879a44d3fe215232098bf428d6412ff22051313e7132df1f06ed840aae81bAA'::hive.operation;
2023-09-19 05:42:49.072 UTC [19284] LOG: terminating any other active server processes
2023-09-19 05:42:49.074 UTC [19284] LOG: all server processes terminated; reinitializing
2023-09-19 05:42:49.094 UTC [19308] LOG: database system was interrupted; last known up at 2023-09-19 05:42:24 UTC
2023-09-19 05:42:49.653 UTC [19308] LOG: database system was not properly shut down; automatic recovery in progress
2023-09-19 05:42:49.664 UTC [19308] LOG: redo starts at D/FC00A0C8
2023-09-19 05:42:49.664 UTC [19308] LOG: invalid record length at D/FC00A100: wanted 24, got 0
2023-09-19 05:42:49.664 UTC [19308] LOG: redo done at D/FC00A0C8 system usage: CPU: user: 0.00 s, system: 0.00 s, elapsed: 0.00 s
2023-09-19 05:42:49.720 UTC [19284] LOG: database system is ready to accept connections
crash callstack from backend process:
(gdb) bt
#0 0x00007fb3ea70247e in __GI___libc_free (mem=0x6b65666164657800) at ./malloc/malloc.c:3368
#1 0x00007fb3de5189f4 in _ZN2fc3raw22unpack_from_char_arrayINS_14static_variantIJN4hive8protocol14vote_operationENS4_17comment_operationENS4_18transfer_operationENS4_29transfer_to_vesting_operationENS4_26withdraw_vesting_operationENS4_28limit_order_create_operationENS4_28limit_order_cancel_operationENS4_22feed_publish_operationENS4_17convert_operationENS4_24account_create_operationENS4_24account_update_operationENS4_24witness_update_operationENS4_30account_witness_vote_operationENS4_31account_witness_proxy_operationENS4_13pow_operationENS4_16custom_operationENS4_31witness_block_approve_operationENS4_24delete_comment_operationENS4_21custom_json_operationENS4_25comment_options_operationENS4_36set_withdraw_vesting_route_operationENS4_29limit_order_create2_operationENS4_23claim_account_operationENS4_32create_claimed_account_operationENS4_34request_account_recovery_operationENS4_25recover_account_operationENS4_33change_recovery_account_operationENS4_25escrow_transfer_operationENS4_24escrow_dispute_operationENS4_24escrow_release_operationENS4_14pow2_operationENS4_24escrow_approve_operationENS4_29transfer_to_savings_operationENS4_31transfer_from_savings_operationENS4_38cancel_transfer_from_savings_operationENS4_23custom_binary_operationENS4_31decline_voting_rights_operationENS4_23reset_account_operationENS4_27set_reset_account_operationENS4_30claim_reward_balance_operationENS4_33delegate_vesting_shares_operationENS4_40account_create_with_delegation_operationENS4_32witness_set_properties_operationENS4_25account_update2_operationENS4_25create_proposal_operationENS4_31update_proposal_votes_operationENS4_25remove_proposal_operationENS4_25update_proposal_operationENS4_32collateralized_convert_operationENS4_28recurrent_transfer_operationENS4_30fill_convert_r--Type <RET> for more, q to quit, c to continue without paging--
equest_operationENS4_23author_reward_operationENS4_25curation_reward_operationENS4_24comment_reward_operationENS4_26liquidity_reward_operationENS4_18interest_operationENS4_31fill_vesting_withdraw_operationENS4_20fill_order_operationENS4_26shutdown_witness_operationENS4_36fill_transfer_from_savings_operationENS4_18hardfork_operationENS4_31comment_payout_update_operationENS4_35return_vesting_delegation_operationENS4_35comment_benefactor_reward_operationENS4_25producer_reward_operationENS4_36clear_null_account_balance_operationENS4_22proposal_pay_operationENS4_21dhf_funding_operationENS4_23hardfork_hive_operationENS4_31hardfork_hive_restore_operationENS4_24delayed_voting_operationENS4_38consolidate_treasury_balance_operationENS4_32effective_comment_vote_operationENS4_36ineffective_delete_comment_operationENS4_24dhf_conversion_operationENS4_38expired_account_notification_operationENS4_34changed_recovery_account_operationENS4_39transfer_to_vesting_completed_operationENS4_20pow_reward_operationENS4_30vesting_shares_split_operationENS4_25account_created_operationENS4_45fill_collateralized_convert_request_operationENS4_24system_warning_operationENS4_33fill_recurrent_transfer_operationENS4_35failed_recurrent_transfer_operationENS4_31limit_order_cancelled_operationENS4_25producer_missed_operationENS4_22proposal_fee_operationENS4_53collateralized_convert_immediate_conversion_operationENS4_25escrow_approved_operationENS4_25escrow_rejected_operationENS4_23proxy_cleared_operationENS4_32declined_voting_rights_operationEEEEEET_PKcjj ()
from /usr/lib/postgresql/14/lib/libhfm-b65974597346902b4b00595f53eb0b308b6f97dd.so
#2 0x00007fb3de2a8ab5 in (anonymous namespace)::validate_raw_data(char const*, unsigned long) ()
--Type <RET> for more, q to quit, c to continue without paging--
from /usr/lib/postgresql/14/lib/libhfm-b65974597346902b4b00595f53eb0b308b6f97dd.so
#3 0x00007fb3de2a8e6e in operation_in () from /usr/lib/postgresql/14/lib/libhfm-b65974597346902b4b00595f53eb0b308b6f97dd.so
#4 0x0000558194cd07a6 in InputFunctionCall ()
#5 0x0000558194935a6a in stringTypeDatum ()
#6 0x0000558194923872 in ?? ()
#7 0x000055819491f8ff in coerce_to_target_type ()
#8 0x000055819492c1d2 in ?? ()
#9 0x000055819492e14c in transformTargetEntry ()
#10 0x0000558194934240 in transformTargetList ()
#11 0x00005581949012f9 in transformStmt ()
#12 0x0000558194902b80 in parse_analyze ()
#13 0x0000558194b77db1 in pg_analyze_and_rewrite ()
#14 0x0000558194b78701 in ?? ()
Edited by Marcin