postgres.git / summary / log / commit / refs

commit    99c3f5e2037bc1192004f3893fd0decd97a7f165
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Thu Sep 17 12:52:30 2026 +0000

    Fix postmaster crash on whitespace-only oauth_validator_libraries
    
    The check_oauth_validator check for an empty validator list didn't test
    for a string with only whitespace, which would cause the postmaster to
    crash.  Instead of testing for the empty string cases, pass the config
    value to SplitDirectoriesString unconditionally.  If an empty list is
    returned then the input string was empty.  Since pstrdup cannot handle
    NULL, assert that the string ie set.  While users cannot set the string
    to NULL, it is initialized to NULL so guard against programmer error.
    
    Check the parsed list instead.  Assert that the GUC string is non-NULL
    before pstrdup(); users cannot set it to NULL, but the C variable is
    initialized that way.
    
    This also adds a TAP test that reloads a whitespace-only setting after
    pg_hba_file_rules and waits until the existing backend sees the restored
    GUC.
    
    Author: Grigorev Jurij <ju.grigorev@ftdata.ru>
    Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
    Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
    Discussion: https://postgr.es/m/04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain
    Backpatch-through: 18


 src/backend/libpq/auth-oauth.c                   | 27 ++++++++++++------------
 src/test/modules/oauth_validator/t/001_server.pl | 18 ++++++++++++++++
 2 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c
index 27f7af7be00..16bd6640de0 100644
--- a/src/backend/libpq/auth-oauth.c
+++ b/src/backend/libpq/auth-oauth.c
@@ -826,20 +826,8 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 
 	*err_msg = NULL;
 
-	if (oauth_validator_libraries_string[0] == '\0')
-	{
-		ereport(elevel,
-				errcode(ERRCODE_CONFIG_FILE_ERROR),
-				errmsg("oauth_validator_libraries must be set for authentication method %s",
-					   "oauth"),
-				errcontext("line %d of configuration file \"%s\"",
-						   line_num, file_name));
-		*err_msg = psprintf("oauth_validator_libraries must be set for authentication method %s",
-							"oauth");
-		return false;
-	}
-
 	/* SplitDirectoriesString needs a modifiable copy */
+	Assert(oauth_validator_libraries_string != NULL);
 	rawstring = pstrdup(oauth_validator_libraries_string);
 
 	if (!SplitDirectoriesString(rawstring, ',', &elemlist))
@@ -854,6 +842,19 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 		goto done;
 	}
 
+	if (elemlist == NIL)
+	{
+		ereport(elevel,
+				errcode(ERRCODE_CONFIG_FILE_ERROR),
+				errmsg("oauth_validator_libraries must be set for authentication method %s",
+					   "oauth"),
+				errcontext("line %d of configuration file \"%s\"",
+						   line_num, file_name));
+		*err_msg = psprintf("oauth_validator_libraries must be set for authentication method %s",
+							"oauth");
+		goto done;
+	}
+
 	if (!hbaline->oauth_validator)
 	{
 		if (elemlist->length == 1)
diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl
index 295342abc69..5b477efde83 100644
--- a/src/test/modules/oauth_validator/t/001_server.pl
+++ b/src/test/modules/oauth_validator/t/001_server.pl
@@ -96,6 +96,24 @@ is( $contents,
 3|oauth|\{issuer=$issuer/param,"scope=openid postgres",validator=validator\}},
 	"pg_hba_file_rules recreates OAuth HBA settings");
 
+# An all-whitespace library list parses as an empty list.  Reject it without
+# crashing the postmaster during HBA reload.
+$node->append_conf('postgresql.conf', "oauth_validator_libraries = '   '");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/parameter "oauth_validator_libraries" must be set for authentication/,
+	$log_start);
+$bgconn->query_safe('SELECT 1');
+
+$node->append_conf('postgresql.conf',
+	"oauth_validator_libraries = 'validator'");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/parameter "oauth_validator_libraries" changed to "validator"/,
+	$log_start);
+is($bgconn->query_safe('SHOW oauth_validator_libraries'),
+	'validator', 'oauth_validator_libraries restored');
+
 # To test against HTTP rather than HTTPS, we need to enable PGOAUTHDEBUG. But
 # first, check to make sure the client refuses such connections by default.
 $node->connect_fails(


[parent: e99e00b2751d]