Re: [GENERAL] Security implications of (plpgsql) functions

Joe Conway <mail(at)joeconway(dot)com> writes:
> Is there any way to recognize infinite recursion by analyzing the saved
> execution tree -- i.e. can we assume that a function that calls itself, with
> the same arguments with which it was called, constitutes infinite recursion?

A bulletproof solution would be equivalent to solving the halting
problem, I believe. The test you mentioned is easily defeated by
recursing between two functions. Also, a would-be instigator of
DOS doesn't need *infinite* recursion; it could be quite finite and
still blow out your stack. For example ask for factorial(10million)
where factorial is defined in the traditional recursive way...

regards, tom lane