Uh oh!
There was an error while loading. Please reload this page.
Fix backend crash in age_create_barbell_graph with a null node label - #2
Merged
NotHimmel merged 1 commit intoAug 18, 2026
Conversation
node_label is declared "name = NULL" in the SQL signature, so leaving it out - or passing NULL explicitly - is a supported call. Both crashed the backend with SIGSEGV, which makes the postmaster reinitialize and drops every other session on the instance. There were two separate faults on that path. First, the default label was copied into a null pointer: Name node_label_name = NULL; ... if (PG_ARGISNULL(3)) namestrcpy(node_label_name, AG_DEFAULT_LABEL_VERTEX); namestrcpy() writes through the pointer it is given and does not allocate, so give the default its own NameData. This also makes the default actually take effect, which it never did. Second, the node label was forwarded to create_complete_graph() as args[3].value. DirectFunctionCall4() marks every argument as not null, so a null node label arrived there as a non-null NULL pointer and was dereferenced by the vertex/edge label comparison. Forward the resolved label instead. create_complete_graph() already handles its own null node label correctly; follow the same approach here. Extend the graph_generation test with the previously untested cases. The existing barbell tests always passed a node label, except for the all-arguments-null case which errors out on the graph name before ever reaching this code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of a fix for the 1.7.0 line. Upstream: apache#2521 (PR), apache#2519 (issue).
Problem
node_labelis declaredname = NULLin the SQL signature ofag_catalog.age_create_barbell_graph(), so leaving it out — or passingNULLexplicitly — is a supported call. Both crash the backend with SIGSEGV, which
makes the postmaster reinitialize and drops every other session on the
instance.
Root cause
Two separate faults on the null-
node_labelpath.1. The default label was copied into a null pointer.
namestrcpy()writes through the pointer it is given and does not allocate.The fix gives the default its own
NameData, which also makes the defaultactually take effect — it never did.
The immediate segfault only happens on PostgreSQL 14 and later.
namestrcpy()used to start with
if (!name || !str) return -1;, removed by PostgreSQLcommit
1784f278a638, first released in 14. On PG 13 and earlier the callsilently did nothing and the failure moved downstream.
2. The node label was forwarded as the raw argument Datum.
DirectFunctionCall4()marks every argument as not null, so a null node labelreached
create_complete_graph()as a non-null NULL pointer and wasdereferenced by its vertex/edge label comparison. Fixing only the
namestrcpy()call is not enough — verified: with just that change,age_create_barbell_graph('g', 5, 0, NULL, NULL, 'E')still segfaults.create_complete_graph()already handles its own null node label correctly;this change makes the barbell function follow the same approach.
Introduced by the original barbell implementation,
0c79370("Barbell graph generation", apache#648, 2023-02-17).
Testing
Extended
regress/sql/graph_generation.sqlwith the previously untested cases.The existing barbell tests always passed a node label, except for the
all-arguments-null case, which errors out on the graph name before reaching
this code — which is why this was never caught.
On PostgreSQL 18.4, built from source:
graph_generationfails withserver closed the connection unexpectedly, and because the crash takes thetemporary instance down with it, the tests that follow fail as well.
# All 31 tests passed.The new cases also confirm the default label is applied:
gp7gets 10 verticesunder
_ag_label_vertex(two K5s) and 21 edges (2 × 10 plus the bridge), andthe three-argument call now returns
ERROR: edge label can not be NULLinstead of crashing.
Out of scope
Three other defects in the same function, left alone to keep this focused:
if (PG_ARGISNULL(1) && PG_GETARG_INT32(1) < 3)should use||(agraph_sizeof 1 or 2 passes silently);node_propertiesandedge_propertiesare accepted but ignored;bridge_sizeis validated butunused, as the in-code comment notes.