jsonb_plperl, jsonb_plpython: Fix unguarded recursion and loops.

Add check_stack_depth() to Jsonb_to_SV, SV_to_JsonbValue,
PLyObject_FromJsonbContainer, and PLyObject_ToJsonbValue.  Without
this, deeply nested JSONB values can crash the backend with SIGSEGV
instead of raising a proper error.

Also add CHECK_FOR_INTERRUPTS() to the while loop in SV_to_JsonbValue
that dereferences chains of Perl references, so that a circular
reference (e.g. $x = \$x) can be cancelled by the user instead of
spinning indefinitely.  (We looked at detecting such circular
references, but it seems more trouble than it's worth.)

Author: Aleksander Alekseev <aleksander@tigerdata.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/CAJ7c6TPbjkzUk4qJ5dHvDNEz0hBuFue3A-XWz_=897z+BC+z8A@mail.gmail.com
Backpatch-through: 14

diff --git a/contrib/jsonb_plperl/jsonb_plperl.c b/contrib/jsonb_plperl/jsonb_plperl.c
index 22e90afe1b6eda8ad7e99dd98302dd34c1eb3087..2f585f083a90768a6dd598f6c0ed448715768aab 100644 (file)
--- a/contrib/jsonb_plperl/jsonb_plperl.c
+++ b/contrib/jsonb_plperl/jsonb_plperl.c
@@ -3,6 +3,7 @@
 #include <math.h>
 
 #include "fmgr.h"
+#include "miscadmin.h"
 #include "plperl.h"
 #include "plperl_helpers.h"
 #include "utils/fmgrprotos.h"
@@ -64,6 +65,9 @@ Jsonb_to_SV(JsonbContainer *jsonb)
        JsonbIterator *it;
        JsonbIteratorToken r;
 
+       /* this can recurse via JsonbValue_to_SV() */
+       check_stack_depth();
+
        it = JsonbIteratorInit(jsonb);
        r = JsonbIteratorNext(&it, &v, true);
 
@@ -177,9 +181,20 @@ SV_to_JsonbValue(SV *in, JsonbParseState **jsonb_state, bool is_elem)
        dTHX;
        JsonbValue      out;                    /* result */
 
+       /* this can recurse via AV_to_JsonbValue() or HV_to_JsonbValue() */
+       check_stack_depth();
+
        /* Dereference references recursively. */
        while (SvROK(in))
+       {
+               /*
+                * It's possible for circular references to make this an infinite
+                * loop.  Checking for such a situation seems like much more trouble
+                * than it's worth, but let's provide a way to break out of the loop.
+                */
+               CHECK_FOR_INTERRUPTS();
                in = SvRV(in);
+       }
 
        switch (SvTYPE(in))
        {

diff --git a/contrib/jsonb_plpython/jsonb_plpython.c b/contrib/jsonb_plpython/jsonb_plpython.c
index 836c17877065c6d2c298bed0d7afdff249048006..8d95f09f23d5eefdce83f7ffd34b59ec42f090d6 100644 (file)
--- a/contrib/jsonb_plpython/jsonb_plpython.c
+++ b/contrib/jsonb_plpython/jsonb_plpython.c
@@ -1,5 +1,6 @@
 #include "postgres.h"
 
+#include "miscadmin.h"
 #include "plpy_elog.h"
 #include "plpy_typeio.h"
 #include "plpython.h"
@@ -145,6 +146,9 @@ PLyObject_FromJsonbContainer(JsonbContainer *jsonb)
        JsonbIterator *it;
        PyObject   *result;
 
+       /* this can recurse via PLyObject_FromJsonbValue() */
+       check_stack_depth();
+
        it = JsonbIteratorInit(jsonb);
        r = JsonbIteratorNext(&it, &v, true);
 
@@ -415,6 +419,9 @@ PLyObject_ToJsonbValue(PyObject *obj, JsonbParseState **jsonb_state, bool is_ele
 {
        JsonbValue *out;
 
+       /* this can recurse via PLyMapping_ToJsonbValue() */
+       check_stack_depth();
+
        if (!(PyString_Check(obj) || PyUnicode_Check(obj)))
        {
                if (PySequence_Check(obj))