postgres.git / summary / log / commit / refs

commit    d7bb9f643b374112cf806b40def8e3783493ebc2
Author:   Fujii Masao <fujii@postgresql.org>
Date:     Thu Jul 16 04:38:34 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6

    Check CREATE_REPLICATION_SLOT response shape in libpqwalreceiver
    
    Previously, libpqrcv_create_slot() checked only that
    CREATE_REPLICATION_SLOT returned PGRES_TUPLES_OK before reading
    values from the first row. If the server unexpectedly returned an
    invalid result, such as zero rows, PQgetvalue() could return NULL,
    leading to a crash while parsing the LSN.
    
    Other replication commands, such as IDENTIFY_SYSTEM, already validate
    the response shape before accessing result values, but
    CREATE_REPLICATION_SLOT did not.
    
    Fix this by verifying that CREATE_REPLICATION_SLOT response contains
    exactly one row with four fields, and report a protocol violation otherwise.
    
    Backpatch to all supported versions.
    
    Bug: #19547
    Reported-by: Yuelin Wang <1217816127@qq.com>
    Author: Kenny Chen <kennychen851228@gmail.com>
    Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com>
    Reviewed-by: Fujii Masao <masao.fujii@gmail.com>
    Discussion: https://postgr.es/m/19547-f7986f668f71e788@postgresql.org
    Discussion: https://postgr.es/m/CAPXstDtW2iqe+DJAOTQTX+rRziJp2UhZSo1+HRj1COAtbu+nKw@mail.gmail.com
    Backpatch-through: 14


 src/backend/replication/libpqwalreceiver/libpqwalreceiver.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
index e0ba1fbc4ff..7b6795c9b59 100644
--- a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
+++ b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
@@ -1101,6 +1101,14 @@ libpqrcv_create_slot(WalReceiverConn *conn, const char *slotname,
 						slotname, pchomp(PQerrorMessage(conn->streamConn)))));
 	}
 
+	/* CREATE_REPLICATION_SLOT returns a single row with four columns */
+	if (PQnfields(res) != 4 || PQntuples(res) != 1)
+		ereport(ERROR,
+				(errcode(ERRCODE_PROTOCOL_VIOLATION),
+				 errmsg("invalid response from primary server"),
+				 errdetail("Could not create replication slot \"%s\": got %d rows and %d fields, expected %d rows and %d fields.",
+						   slotname, PQntuples(res), PQnfields(res), 1, 4)));
+
 	if (lsn)
 		*lsn = DatumGetLSN(DirectFunctionCall1Coll(pg_lsn_in, InvalidOid,
 												   CStringGetDatum(PQgetvalue(res, 0, 1))));


[parent: daf029831d6b]