postgres.git / summary / log / commit / refs

commit    31d0b917d162b4d5401e1f0ebd27f987d44cbabf
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Mon Feb 16 23:41:34 2026 +0000

    hstore: Fix NULL pointer dereference with receive function
    
    The receive function of hstore was not able to handle correctly
    duplicate key values when a new duplicate links to a NULL value, where a
    pfree() could be attempted on a NULL pointer, crashing due to a pointer
    dereference.
    
    This problem would happen for a COPY BINARY, when stacking values like
    that:
    aa => 5
    aa => null
    
    The second key/value pair is discarded and pfree() calls are attempted
    on its key and its value, leading to a pointer dereference for the value
    part as the value is NULL.  The first key/value pair takes priority when
    a duplicate is found.
    
    Per offline report.
    
    Reported-by: "Anemone" <vergissmeinnichtzh@gmail.com>
    Reported-by: "A1ex" <alex000young@gmail.com>
    Backpatch-through: 14


 contrib/hstore/hstore_io.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/contrib/hstore/hstore_io.c b/contrib/hstore/hstore_io.c
index 08c1b216aa2..b6157699af1 100644
--- a/contrib/hstore/hstore_io.c
+++ b/contrib/hstore/hstore_io.c
@@ -382,7 +382,8 @@ hstoreUniquePairs(Pairs *a, int32 l, int32 *buflen)
 			if (ptr->needfree)
 			{
 				pfree(ptr->key);
-				pfree(ptr->val);
+				if (ptr->val != NULL)
+					pfree(ptr->val);
 			}
 		}
 		else


[parent: 23064542f8bd]