hstore bug and repair method

Hi all:

I’ve found a bug about hstore, example below:

CREATE TABLE temp_table (

dcp smallint,

atext hstore

);

COPY temp_table (dcp, atext) FROM stdin;

800 ""=>NULL

\.

Then do the sql twice below :

Select * from temp_table;

Pg(version 8.3 and above) will coredump, backtrace below:

Program received signal SIGABRT, Aborted.

0x0000002a95a5821d in raise () from /lib64/tls/libc.so.6

(gdb) bt

#0 0x0000002a95a5821d in raise () from /lib64/tls/libc.so.6

#1 0x0000002a95a59a1e in abort () from /lib64/tls/libc.so.6

#2 0x0000000000724b50 in ExceptionalCondition (conditionName=Could not find
the frame base for "ExceptionalCondition".

) at assert.c:57

#3 0x0000000000747c6f in pfree (pointer=0xb11290) at mcxt.c:591

#4 0x000000000044a500 in printtup (slot=0xb101d8, self=0xb1bac0) at
printtup.c:344

#5 0x0000000000572de9 in ExecSelect (slot=0xb101d8, dest=0xb1bac0,
estate=0xb10058) at execMain.c:1554

#6 0x0000000000572c70 in ExecutePlan (estate=0xb10058, planstate=0xb10388,
operation=CMD_SELECT, numberTuples=0,

direction=ForwardScanDirection, dest=0xb1bac0) at execMain.c:1480

#7 0x0000000000570ebe in ExecutorRun (queryDesc=0xb1d910,
direction=ForwardScanDirection, count=0) at execMain.c:270

#8 0x000000000064b6ad in PortalRunSelect (portal=0xb06fd8, forward=1
'\001', count=0, dest=0xb1bac0) at pquery.c:943

#9 0x000000000064b34d in PortalRun (portal=0xb06fd8,
count=9223372036854775807, isTopLevel=1 '\001', dest=0xb1bac0,

altdest=0xb1bac0, completionTag=0x7fbfffee60 "") at pquery.c:769

#10 0x0000000000645a0d in exec_simple_query (query_string=0xac5c88 "select *
from temp_table ;") at postgres.c:1004

#11 0x00000000006497a0 in PostgresMain (argc=4, argv=0xa45948,
username=0xa45920 "cherokee") at postgres.c:3631

#12 0x000000000060ba2e in BackendRun (port=0xa468f0) at postmaster.c:3207

#13 0x000000000060afbd in BackendStartup (port=0xa468f0) at
postmaster.c:2830

#14 0x0000000000608b7c in ServerLoop () at postmaster.c:1274

#15 0x000000000060855d in PostmasterMain (argc=3, argv=0xa25c30) at
postmaster.c:1029

#16 0x00000000005a1dcb in main (argc=3, argv=0xa25c30) at main.c:188

The repair method is :

Hstore_io.c:

440 buflen = (4 /* " */ + 2 /* => */ + 2 /* , */ ) * in->size +

441 2 /* esc */ * (VARSIZE(in) - CALCDATASIZE(in->size, 0));

442

443 -- out = ptr = palloc(buflen);

++ out = ptr = palloc(buflen+1);

此致

敬礼

茂森