postgres.git / summary / log / commit / refs

commit    b2e391aea58834b36722a60351900f5f7617f9fc
Author:   Fujii Masao <fujii@postgresql.org>
Date:     Wed Aug 19 03:34:28 2026 +0000

    psql: Avoid returning oom_buffer from psql slash option scanner
    
    psql_scan_slash_option() builds option text in a local PQExpBufferData
    and returns the buffer's data pointer to its caller. If either the initial
    allocation or a later enlargement failed, that data pointer could be
    the static PQExpBuffer OOM buffer rather than malloc-owned storage.
    The callers could then eventually pass it to free(), causing undefined
    behavior.
    
    Detect a broken option buffer before returning it, report OOM, and return
    NULL instead. Also avoid evaluating a backtick substitution when the option
    buffer is already broken, since doing so could otherwise touch the static
    OOM buffer.
    
    This keeps the existing NULL-return convention for slash options. Callers
    are not generally changed to distinguish OOM from no option.
    
    Backpatch to all supported versions.
    
    Reported-by: Junwang Zhao <zhjwpku@gmail.com>
    Author: Fujii Masao <masao.fujii@gmail.com>
    Reviewed-by: Chao Li <li.evan.chao@gmail.com>
    Reviewed-by: Junwang Zhao <zhjwpku@gmail.com>
    Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com
    Backpatch-through: 14


 src/bin/psql/command.c       |  2 +-
 src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c
index be9e3b035e2..0f09fa95995 100644
--- a/src/bin/psql/command.c
+++ b/src/bin/psql/command.c
@@ -1975,7 +1975,7 @@ exec_command_lo(PsqlScanState scan_state, bool active_branch, const char *cmd)
 
 		if (strcmp(cmd + 3, "export") == 0)
 		{
-			if (!opt2)
+			if (!opt1 || !opt2)
 			{
 				pg_log_error("\\%s: missing required argument", cmd);
 				success = false;
diff --git a/src/bin/psql/psqlscanslash.l b/src/bin/psql/psqlscanslash.l
index 0af91cba6bd..e2a3a15bea1 100644
--- a/src/bin/psql/psqlscanslash.l
+++ b/src/bin/psql/psqlscanslash.l
@@ -534,7 +534,8 @@ psql_scan_slash_command(PsqlScanState state)
 
 /*
  * Parse off the next argument for a backslash command, and return it as a
- * malloc'd string.  If there are no more arguments, returns NULL.
+ * malloc'd string.  If there are no more arguments or on out-of-memory,
+ * returns NULL.
  *
  * type tells what processing, if any, to perform on the option string;
  * for example, if it's a SQL identifier, we want to downcase any unquoted
@@ -611,6 +612,16 @@ psql_scan_slash_option(PsqlScanState state,
 	 */
 	Assert(lexresult == LEXRES_EOL || lexresult == LEXRES_OK);
 
+	/*
+	 * yylex() appends option text to mybuf, so a buffer enlargement failure
+	 * during lexing can leave mybuf broken even if initialization succeeded.
+	 */
+	if (PQExpBufferDataBroken(mybuf))
+	{
+		pg_log_error("out of memory");
+		return NULL;
+	}
+
 	switch (final_state)
 	{
 		case xslashargstart:
@@ -819,13 +830,22 @@ static void
 evaluate_backtick(PsqlScanState state)
 {
 	PQExpBuffer output_buf = state->output_buf;
-	char	   *cmd = output_buf->data + backtick_start_offset;
+	char	   *cmd;
 	PQExpBufferData cmd_output;
 	FILE	   *fd;
 	bool		error = false;
 	char		buf[512];
 	size_t		result;
 
+	/*
+	 * The option buffer is already broken; avoid touching the static
+	 * oom_buffer and let psql_scan_slash_option() return NULL.
+	 */
+	if (PQExpBufferBroken(output_buf))
+		return;
+
+	cmd = output_buf->data + backtick_start_offset;
+
 	initPQExpBuffer(&cmd_output);
 
 	fd = popen(cmd, "r");


[parent: b57f962201b2]