Fix crash in PREPARE with property parameter when enable_containment is off

[gregfelice]

Summary

• Fixes server crash (segfault) when executing PREPARE with a property parameter ($props) while age.enable_containment is set to off
• Root cause: create_property_constraints blindly casts cypher_param nodes to cypher_map* in the non-containment code path, then dereferences the keyvals field which maps to the name char pointer of cypher_param — reading invalid memory
• Also fixes unsafe keep_null writes on cypher_param nodes in transform_match_entities for both vertex and edge property constraints

Reproducer

LOAD 'age';
SET search_path TO ag_catalog;
SET age.enable_containment = off;

PREPARE ptest(agtype) AS
  SELECT * FROM cypher('graph', $$MATCH (n $props) RETURN n $$, $1) AS (p agtype);
-- Server crashes with SIGSEGV

GDB backtrace

Program received signal SIGSEGV, Segmentation fault.
transform_map_to_ind_recursive (cpstate=0x5e73d71659e0, entity=0x5e73d7166878,
    map=0x5e73d7073b58, parent_fields=0x0) at src/backend/parser/cypher_clause.c:4055
4055        key = (Node *)map->keyvals->elements[i].ptr_value;

#0  transform_map_to_ind_recursive at src/backend/parser/cypher_clause.c:4055
#1  transform_map_to_ind at src/backend/parser/cypher_clause.c:4006
#2  create_property_constraints at src/backend/parser/cypher_clause.c:4248
#3  transform_match_entities at src/backend/parser/cypher_clause.c:4678
#4  transform_match_path at src/backend/parser/cypher_clause.c:4268
#5  transform_match_pattern at src/backend/parser/cypher_clause.c:3349
...

The crash occurs because map is actually a cypher_param node ({extensible, name, location}), not a cypher_map ({extensible, keyvals, location, keep_null}). The name char pointer is reinterpreted as the keyvals List pointer, and dereferencing it as keyvals->elements[i].ptr_value accesses invalid memory.

Root cause analysis

When age.enable_containment = on (the default), create_property_constraints handles property parameters correctly:

1. transform_cypher_expr() dispatches cypher_param to transform_cypher_param(), producing a FuncExpr that resolves the parameter at execution time
2. The result is used with the @> containment operator: properties @> $props

When age.enable_containment = off, the code takes the else branch (line 4246) which calls transform_map_to_ind(). This function is designed to decompose a known cypher_map ({key1: val1, key2: val2}) into individual index-based equality expressions (properties->"key1" = val1 AND properties->"key2" = val2). It cannot work with a cypher_param because the map keys are not known until execution time.

Additionally, transform_match_entities writes keep_null = true by casting node->props / rel->props to cypher_map* (lines 4677 and 4806 on master) without checking the actual node type, corrupting the cypher_param struct.

Fix

Three changes in cypher_clause.c:

1. create_property_constraints: Before the cypher_map cast, check is_ag_node(property_constraints, cypher_param). For parameters, fall back to the containment operator (@>), which correctly resolves at execution time. This matches the behavior of the enable_containment = on path.

2. transform_match_entities (vertex): Guard the keep_null assignment with is_ag_node(node->props, cypher_map) to prevent writing to wrong struct memory.

3. transform_match_entities (edge): Same guard for is_ag_node(rel->props, cypher_map).

Test plan

• Regression test added: PREPARE/EXECUTE with vertex and edge property parameters, both enable_containment = on and off
• All 31 existing regression tests pass
• Verified correct query results (not just no-crash) for parameterized property matching
• Code style matches surrounding codebase (ISO C90 declarations, brace placement, argument alignment)

Fixes #1964

AI Disclosure

AI tools (Claude by Anthropic) were used to assist in developing this fix, including root cause analysis, code changes, and regression tests.

[Copilot]

Pull request overview

Fixes a server crash in the Cypher MATCH property-constraints transformation when PREPARE is used with a property parameter ($props) while age.enable_containment = off, and adds regression coverage for the reported crash scenario.

Changes:

• Add a cypher_param type check in create_property_constraints() to avoid incorrectly treating runtime parameters as parse-time maps.
• Guard keep_null writes in transform_match_entities() so cypher_param nodes aren’t corrupted by cypher_map casts.
• Add regression tests and expected output for PREPARE/EXECUTE with vertex/edge property parameters under both containment modes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/backend/parser/cypher_clause.c	Prevents invalid casts/dereferences for $props when containment is disabled; avoids unsafe keep_null writes.
regress/sql/cypher_match.sql	Adds regression SQL reproducing Issue #1964 for vertex and edge property parameters with PREPARE.
regress/expected/cypher_match.out	Updates expected output to match new regression coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.