Context Navigation

← Previous Ticket
Next Ticket →

#3392 closed defect (fixed)

ST_AsGeoJSON crashes backend

Reported by:	bhodgen	Owned by:	pramsey
Priority:	medium	Milestone:	PostGIS 2.1.9
Component:	postgis	Version:	2.1.x
Keywords:		Cc:

Description

Version Info

Ubuntu Server: 14.04.3 LTS 64bit

POSTGIS="2.1.8 r13780" GEOS="3.4.2-CAPI-1.8.2 r3921" PROJ="Rel. 4.8.0, 6 March 2012" GDAL="GDAL 1.10.1, released 2013/08/26" LIBXML="2.9.1" LIBJSON="UNKNOWN" TOPOLOGY RASTER

PostgreSQL 9.4.5 on x86_64-unknown-linux-gnu, compiled by gcc (Ubuntu 4.8.2-19ubuntu1) 4.8.2, 64-bit

Issue

We have observed this issue on three separate VM's running in HyperV, and one instance in VMWare Fusion 8 I setup to verify the problem. The issue is triggered when using a plpgsql function that has a search_path set, and with the ST_AsGeoJSON function called on an empty geometry.

This is pretty weird edge case and we are able to work around it, but I thought I would file a ticket in case this behavior is indicative of a larger issue somewhere in the code base.

We found the issue in a function we use to calculate the area of a geometry, and originally thought it was an issue with our function. However, after further research it seems like any function that explicitly alters set_path will exhibit the problem. I used the following function to replicate the issue.

CREATE SCHEMA common;

CREATE OR REPLACE FUNCTION common.sad_panda(geom geometry)
    RETURNS integer AS
$$
BEGIN
    RETURN 1;
END;
$$
LANGUAGE 'plpgsql' IMMUTABLE SECURITY DEFINER;
ALTER FUNCTION common.sad_panda(geom geometry) SET search_path = common;

After you have created the schema and function above, running the following query will crash PostgreSQL. It doesn't matter if you use a CTE, or select the data from a table, as long as the geometry is empty it will crash the server.

WITH empty_geoms AS (
   SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
)
SELECT common.sad_panda(geom),st_asgeojson(geom) 
FROM empty_geoms;

Other Info

Changing the order of the selectors resolves the issue, as the following query will work without any problems.

WITH empty_geoms AS (
   SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
)
SELECT st_asgeojson(geom), common.sad_panda(geom) 
FROM empty_geoms;

Removing the search_path from the function also resolves the issue. We haven't tried creating the function in the public schema, but setting the search_path to public (the default when creating a function I believe) still exhibits the problem.

CREATE SCHEMA common;

CREATE OR REPLACE FUNCTION common.sad_panda(geom geometry)
    RETURNS integer AS
$$
BEGIN
    RETURN 1;
END;
$$
LANGUAGE 'plpgsql' IMMUTABLE SECURITY DEFINER;
--ALTER FUNCTION common.sad_panda(geom geometry) SET search_path = common;

If you run the following query right after crashing the database...

WITH empty_geoms AS (
   SELECT st_geomfromtext('POLYGON EMPTY',4326) as geom
)
SELECT st_asgeojson(geom),common.sad_panda(geom),st_asgeojson(geom) 
FROM empty_geoms;

you get the following error message.

ERROR:  lwgeom_free called with unknown type (105) Invalid type

********** Error **********

ERROR: lwgeom_free called with unknown type (105) Invalid type
SQL state: XX000