postgres.git / summary / log / commit / refs

commit    e520ad34b482cc3a441f10ded0320d42db2625ed
Author:   Richard Guo <rguo@postgresql.org>
Date:     Wed Jun 24 00:09:48 2026 +0000

    plperl: Fix NULL pointer dereference for forged array object
    
    In get_perl_array_ref(), for a PostgreSQL::InServer::ARRAY object, we
    look up its "array" key with hv_fetch_string() and then inspect the
    returned SV.  However, hv_fetch_string() returns a NULL pointer when
    the key is absent, and the code dereferenced that result without first
    checking whether the pointer itself was NULL.  As a result, a plperl
    function returning a forged PostgreSQL::InServer::ARRAY object that
    lacks the "array" key would crash the backend with a segmentation
    fault.
    
    Fix this by checking the pointer returned by hv_fetch_string() before
    dereferencing it, matching how other callers in this file already
    guard the result.  With the check in place, such an object falls
    through to the existing error report instead of crashing.
    
    Author: Xing Guo <higuoxing@gmail.com>
    Reviewed-by: Richard Guo <guofenglinux@gmail.com>
    Discussion: https://postgr.es/m/CACpMh+DYgcnqZwQLXXuxQcehJTd7T8UmKWSLsK4mFBEp9G2ajA@mail.gmail.com
    Backpatch-through: 14


 src/pl/plperl/expected/plperl_array.out | 7 +++++++
 src/pl/plperl/plperl.c                  | 2 +-
 src/pl/plperl/sql/plperl_array.sql      | 7 +++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/pl/plperl/expected/plperl_array.out b/src/pl/plperl/expected/plperl_array.out
index bd04a062fb9..03e5629d699 100644
--- a/src/pl/plperl/expected/plperl_array.out
+++ b/src/pl/plperl/expected/plperl_array.out
@@ -274,3 +274,10 @@ select perl_setof_array('{{1}, {2}, {3}}');
  {3}
 (3 rows)
 
+-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
+CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
+	return bless {}, "PostgreSQL::InServer::ARRAY";
+$$ LANGUAGE plperl;
+SELECT perl_forged_array();
+ERROR:  could not get array reference from PostgreSQL::InServer::ARRAY object
+CONTEXT:  PL/Perl function "perl_forged_array"
diff --git a/src/pl/plperl/plperl.c b/src/pl/plperl/plperl.c
index fe6efdb3740..b3834f71424 100644
--- a/src/pl/plperl/plperl.c
+++ b/src/pl/plperl/plperl.c
@@ -1151,7 +1151,7 @@ get_perl_array_ref(SV *sv)
 			HV		   *hv = (HV *) SvRV(sv);
 			SV		  **sav = hv_fetch_string(hv, "array");
 
-			if (*sav && SvOK(*sav) && SvROK(*sav) &&
+			if (sav && *sav && SvOK(*sav) && SvROK(*sav) &&
 				SvTYPE(SvRV(*sav)) == SVt_PVAV)
 				return *sav;
 
diff --git a/src/pl/plperl/sql/plperl_array.sql b/src/pl/plperl/sql/plperl_array.sql
index ca63b5db625..cd1d7e34c50 100644
--- a/src/pl/plperl/sql/plperl_array.sql
+++ b/src/pl/plperl/sql/plperl_array.sql
@@ -206,3 +206,10 @@ create or replace function perl_setof_array(integer[]) returns setof integer[] l
 $$;
 
 select perl_setof_array('{{1}, {2}, {3}}');
+
+-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
+CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
+	return bless {}, "PostgreSQL::InServer::ARRAY";
+$$ LANGUAGE plperl;
+
+SELECT perl_forged_array();


[parent: e8fbe5d838f5]