Re: BUG #17962: postgresql 11 hangs on poly_contain with specific data

At Mon, 05 Jun 2023 11:34:17 +0000, PG Bug reporting form <noreply(at)postgresql(dot)org> wrote in
> While doing fuzzing testing I've found an input data for poly_contain
> operation that hangs postgresql 11 forever (or for a very long time), with
> backend eating 100% of cpu.

The query leads to infinite loop involving
touched_lseg_inside_poly. Thanks for reporting.

> Sorry there is no file attach option in bug report form.
>
> I guess this issue might be known, as it is not reproducible in latter
> versions, but still I guess it is better to report it.

Thanks! I could reproduce the issue here using it. In this case,
on_ps_internal() gives a wrong result for, for example, the following
input.

point pa {x = 0.011698969004501018, y = -9.0711677068731452e-257}
lseg {p1 {x = -0.0036183721265742744, y = 4.2781805177680175e+48},
p2 {x = 2.4676134855730224e-152, y = 7.6266955589918203e+100}}

The point is evidently not on the lseg, but on_ps_internal(point,
lseg) returns true. Underflow in on_ps_internal() is causing this
mishap.

A feasible fix might be to detect infinite recursion. The attached
works for the this specific case well.

regards.

--
Kyotaro Horiguchi
NTT Open Source Software Center