postgres.git / summary / log / commit / refs

commit    1d094904bc76b57fa1fd634b9c49bbb5ab76ece7
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Thu Sep 17 12:52:30 2026 +0000

    Fix postmaster crash on whitespace-only oauth_validator_libraries
    
    The check_oauth_validator check for an empty validator list didn't test
    for a string with only whitespace, which would cause the postmaster to
    crash.  Instead of testing for the empty string cases, pass the config
    value to SplitDirectoriesString unconditionally.  If an empty list is
    returned then the input string was empty.  Since pstrdup cannot handle
    NULL, assert that the string ie set.  While users cannot set the string
    to NULL, it is initialized to NULL so guard against programmer error.
    
    Check the parsed list instead.  Assert that the GUC string is non-NULL
    before pstrdup(); users cannot set it to NULL, but the C variable is
    initialized that way.
    
    This also adds a TAP test that reloads a whitespace-only setting after
    pg_hba_file_rules and waits until the existing backend sees the restored
    GUC.
    
    Author: Grigorev Jurij <ju.grigorev@ftdata.ru>
    Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
    Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
    Discussion: https://postgr.es/m/04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain
    Backpatch-through: 18


 src/backend/libpq/auth-oauth.c                   | 27 ++++++++++++------------
 src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++
 2 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c
index b769931ca4f..fb830065fba 100644
--- a/src/backend/libpq/auth-oauth.c
+++ b/src/backend/libpq/auth-oauth.c
@@ -863,20 +863,8 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 
 	*err_msg = NULL;
 
-	if (oauth_validator_libraries_string[0] == '\0')
-	{
-		ereport(elevel,
-				errcode(ERRCODE_CONFIG_FILE_ERROR),
-				errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
-					   "oauth_validator_libraries", "oauth"),
-				errcontext("line %d of configuration file \"%s\"",
-						   line_num, file_name));
-		*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
-							"oauth_validator_libraries", "oauth");
-		return false;
-	}
-
 	/* SplitDirectoriesString needs a modifiable copy */
+	Assert(oauth_validator_libraries_string != NULL);
 	rawstring = pstrdup(oauth_validator_libraries_string);
 
 	if (!SplitDirectoriesString(rawstring, ',', &elemlist))
@@ -891,6 +879,19 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 		goto done;
 	}
 
+	if (elemlist == NIL)
+	{
+		ereport(elevel,
+				errcode(ERRCODE_CONFIG_FILE_ERROR),
+				errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
+					   "oauth_validator_libraries", "oauth"),
+				errcontext("line %d of configuration file \"%s\"",
+						   line_num, file_name));
+		*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
+							"oauth_validator_libraries", "oauth");
+		goto done;
+	}
+
 	if (!hbaline->oauth_validator)
 	{
 		if (elemlist->length == 1)
diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl
index 8941a355423..fb76c69c1ca 100644
--- a/src/test/modules/oauth_validator/t/001_server.pl
+++ b/src/test/modules/oauth_validator/t/001_server.pl
@@ -134,6 +134,24 @@ is( $contents,
 3|oauth|\{issuer=$issuer/param,"scope=openid postgres",validator=validator\}},
 	"pg_hba_file_rules recreates OAuth HBA settings");
 
+# An all-whitespace library list parses as an empty list.  Reject it without
+# crashing the postmaster during HBA reload.
+$node->append_conf('postgresql.conf', "oauth_validator_libraries = '   '");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/parameter "oauth_validator_libraries" must be set for authentication/,
+	$log_start);
+$bgconn->query_safe('SELECT 1');
+
+$node->append_conf('postgresql.conf',
+	"oauth_validator_libraries = 'validator'");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/parameter "oauth_validator_libraries" changed to "validator"/,
+	$log_start);
+is($bgconn->query_safe('SHOW oauth_validator_libraries'),
+	'validator', 'oauth_validator_libraries restored');
+
 {
 	# Make sure PGOAUTHDEBUG=UNSAFE doesn't disable certificate verification.
 	local $ENV{PGOAUTHDEBUG} = "UNSAFE";


[parent: 746a507a391b]