MIME-Version: 1.0
References: <6c6cc4b06b8e4f3ab91029c5e7f2e479@rutoken.ru>
In-Reply-To: <6c6cc4b06b8e4f3ab91029c5e7f2e479@rutoken.ru>
From: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Date: Mon, 6 Apr 2026 14:10:25 +0530
Message-ID: 
 <CAG7mmoy9DR-_tCintwCjcWJO5KbyLCikqffFox1-_vXkJwZHpw@mail.gmail.com>
Subject: Re: DEREF_AFTER_NULL: src/common/jsonapi.c:2529
To: =?UTF-8?B?0JPQsNC70LrQuNC9INCh0LXRgNCz0LXQuQ==?= <galkin@rutoken.ru>
Cc: "pgadmin-hackers@lists.postgresql.org"
 <pgadmin-hackers@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000e4db38064ec69e98"
Archived-At: 
 <https://www.postgresql.org/message-id/CAG7mmoy9DR-_tCintwCjcWJO5KbyLCikqffFox1-_vXkJwZHpw%40mail.gmail.com>
Precedence: bulk

--000000000000e4db38064ec69e98
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This is email chain for pgAdmin hackers (and - not PostgreSQL hackers).
Please share your patch at pgsql-hackers@postgresql.org .

--

Thanks & Regards,

Ashesh Vashi
EnterpriseDB INDIA: Enterprise PostgreSQL Company
<http://www.enterprisedb.com>


*http://www.linkedin.com/in/asheshvashi*
<http://www.linkedin.com/in/asheshvashi>


On Mon, Apr 6, 2026 at 1:40=E2=80=AFPM =D0=93=D0=B0=D0=BB=D0=BA=D0=B8=D0=BD=
 =D0=A1=D0=B5=D1=80=D0=B3=D0=B5=D0=B9 <galkin@rutoken.ru> wrote:

> Hello, a static analyzer pointed out a possible NULL dereference at the
> end of json_errdetail() (src/common/jsonapi.c):
>
> return lex->errormsg->data;
>
> That seemed plausible to me, since there is a comment just above saying
> that lex->errormsg can be NULL in shlib code. I also checked
> PQExpBufferBroken(), and it does handle NULL, but that call is under
> #ifdef, while the final access to lex->errormsg->data is unconditional.
>
> I may be missing some invariant here, but it seems worth adding an
> explicit NULL check. I prepared a corresponding patch and am attaching it
> below in case you agree that this is a real issue.
>
> diff --git a/src/common/jsonapi.c b/src/common/jsonapi.c
> index 1145d93945f..192040b5443 100644
> --- a/src/common/jsonapi.c
> +++ b/src/common/jsonapi.c
> @@ -2525,6 +2525,9 @@ json_errdetail(JsonParseErrorType error,
> JsonLexContext *lex)
>      if (PQExpBufferBroken(lex->errormsg))
>          return _("out of memory while constructing error description");
>  #endif
> +
> +    if (!lex->errormsg)
> +        return _("out of memory while constructing error description");
>
>      return lex->errormsg->data;
>  }
>
> Best regards, Galkin Sergey
>
>

--000000000000e4db38064ec69e98
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>This is email chain for pgAdmin hackers (and - not Po=
stgreSQL hackers).<br>Please share your patch at=C2=A0<a href=3D"mailto:pgs=
ql-hackers@postgresql.org">pgsql-hackers@postgresql.org</a> .<br><br></div>=
<div><div dir=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_sig=
nature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div style=3D"margin:0pt 0pt=
 8px"><p style=3D"margin:0pt"><span style=3D"font-family:courier new,monosp=
ace"><span style=3D"font-style:italic"><span>--</span></span></span></p><p =
style=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><spa=
n style=3D"font-style:italic"><span>Thanks &amp; Regards,</span></span><br =
style=3D"font-style:italic"><br style=3D"font-style:italic"><span style=3D"=
font-style:italic">Ashesh Vashi</span><br style=3D"font-style:italic"><span=
 style=3D"font-style:italic">EnterpriseDB INDIA: </span><a href=3D"http://w=
ww.enterprisedb.com" target=3D"_blank">Enterprise PostgreSQL Company</a></s=
pan></p>
<p style=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><=
br></span></p>
<p style=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><=
a href=3D"http://www.linkedin.com/in/asheshvashi" target=3D"_blank"><i>http=
://www.linkedin.com/in/asheshvashi</i></a></span></p></div></div></div></di=
v></div></div><br></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cla=
ss=3D"gmail_attr">On Mon, Apr 6, 2026 at 1:40=E2=80=AFPM =D0=93=D0=B0=D0=BB=
=D0=BA=D0=B8=D0=BD =D0=A1=D0=B5=D1=80=D0=B3=D0=B5=D0=B9 &lt;<a href=3D"mail=
to:galkin@rutoken.ru" target=3D"_blank">galkin@rutoken.ru</a>&gt; wrote:<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;=
border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>


<div dir=3D"ltr">
<div id=3D"m_557104293729814085m_-8217178607485408356divtagdefaultwrapper" =
style=3D"font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans=
-serif" dir=3D"ltr">
<p></p>
<div>Hello,=C2=A0a static analyzer pointed out a possible NULL dereference =
at the end of json_errdetail()=C2=A0(<span>src/common/jsonapi.c)</span>:<br=
>
<br>
return lex-&gt;errormsg-&gt;data;<br>
</div>
<div><br>
That seemed plausible to me, since there is a comment just above saying tha=
t lex-&gt;errormsg can be NULL in shlib code. I also checked PQExpBufferBro=
ken(), and it does handle NULL, but that call is under #ifdef, while the fi=
nal access to lex-&gt;errormsg-&gt;data is
 unconditional.<br>
<br>
I may be missing some invariant here, but it seems worth adding an explicit=
 NULL check. I<span>=C2=A0prepared a corresponding patch and am attaching i=
t below in case you agree that this is a real issue.</span><br>
<br>
<div>diff --git a/src/common/jsonapi.c b/src/common/jsonapi.c<br>
index 1145d93945f..192040b5443 100644<br>
--- a/src/common/jsonapi.c<br>
+++ b/src/common/jsonapi.c<br>
@@ -2525,6 +2525,9 @@ json_errdetail(JsonParseErrorType error, JsonLexConte=
xt *lex)<br>
=C2=A0 =C2=A0 =C2=A0if (PQExpBufferBroken(lex-&gt;errormsg))<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return _(&quot;out of memory while constr=
ucting error description&quot;);<br>
=C2=A0#endif<br>
+=C2=A0 =C2=A0=C2=A0<br>
+=C2=A0 =C2=A0 if (!lex-&gt;errormsg)<br>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 return _(&quot;out of memory while constructin=
g error description&quot;);<br>
=C2=A0<br>
=C2=A0 =C2=A0 =C2=A0return lex-&gt;errormsg-&gt;data;<br>
=C2=A0}</div>
<br>
Best regards, Galkin Sergey</div>
<p></p>
</div>
</div>

</div></blockquote></div>

--000000000000e4db38064ec69e98--