From: Grigorev Jurij <ju.grigorev@ftdata.ru>
To: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
CC: "jacob.champion@enterprisedb.com" <jacob.champion@enterprisedb.com>,
	"daniel@yesql.se" <daniel@yesql.se>
Subject: Postmaster crashes on SIGHUP when oauth_validator_libraries holds
 only whitespace
Thread-Topic: Postmaster crashes on SIGHUP when oauth_validator_libraries
 holds only whitespace
Thread-Index: AQHdRDtZKXFGhwTBsEutXNp1kv9EqQ==
Date: Mon, 14 Sep 2026 11:22:42 +0000
Message-ID: <04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain>
Accept-Language: ru-RU, en-US
Content-Language: ru-RU
Content-Type: multipart/mixed;
	boundary="_002_04fa84f6ebbe400f940e179ebe1070e9ftdataru_"
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/04fa84f6ebbe400f940e179ebe1070e9%40localhost.localdomain>
Precedence: bulk

--_002_04fa84f6ebbe400f940e179ebe1070e9ftdataru_
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

Hi,

I ran into a postmaster crash while investigating a static analyzer
report against 18.6.  I reproduced it on master (92aaf50e230,
--enable-cassert, Debian 13/aarch64).

To reproduce, set the following in postgresql.conf:

	oauth_validator_libraries =3D '   '

and add an OAuth line without validator=3D to pg_hba.conf:

	host all all 127.0.0.1/32 oauth issuer=3D"https://example.com" scope=3D"op=
enid"

On reload the server log ends here:

	LOG:  received SIGHUP, reloading configuration files
	LOG:  parameter "oauth_validator_libraries" changed to "   "

gdb then reports SIGSEGV in check_oauth_validator(), via load_hba().
The running instance goes down with every session on it.  The same
configuration also prevents startup.  pg_hba_file_rules() parses the
file from a regular backend, so the same NULL dereference there kills
the backend and the postmaster restarts the cluster.

check_oauth_validator() treats an unset list as an error by looking at
the raw GUC string, but SplitDirectoriesString() accepts a string of
spaces and returns NIL.  The subsequent elemlist->length dereferences
that.  This is a misconfiguration rather than a security issue -- the
GUC has PGC_SIGHUP context and is marked GUC_SUPERUSER_ONLY.

I've attached a patch against master that checks the parsed list
instead.  It also adds a TAP test for reload.  The patched master built
without warnings, and "make check" in src/test/modules/oauth_validator
passed with PG_TEST_EXTRA=3Doauth.

This appears to affect v18 onward, where OAuth support was added, so it
may need back-patching.  The v18 error message has different wording
and would need a small adjustment.

Could someone take a look at the attached patch and let me know
if this is the right fix?

Thanks,
  Yuriy=

--_002_04fa84f6ebbe400f940e179ebe1070e9ftdataru_
Content-Type: application/octet-stream;
	name="v1-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch"
Content-Description: 
 v1-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch
Content-Disposition: attachment;
	filename="v1-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch";
	size=4154; creation-date="Mon, 14 Sep 2026 11:20:12 GMT";
	modification-date="Mon, 14 Sep 2026 11:20:12 GMT"
Content-Transfer-Encoding: base64

RnJvbSBjZjc2NmVhNTk2MTRlM2M3MmE2OThlNGY2ZGM0Y2Q5MTlkYTFiMGQ1IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBZdXJpeSBHcmlnb3J5ZXYgPGp1LmdyaWdvcmV2QGZ0ZGF0YS5y
dT4KRGF0ZTogTW9uLCAxNCBTZXAgMjAyNiAxNTozMToyMiArMDcwMApTdWJqZWN0OiBbUEFUQ0hd
IEZpeCBwb3N0bWFzdGVyIGNyYXNoIG9uIHdoaXRlc3BhY2Utb25seQogb2F1dGhfdmFsaWRhdG9y
X2xpYnJhcmllcwoKY2hlY2tfb2F1dGhfdmFsaWRhdG9yKCkgcmVqZWN0cyBhbiB1bnNldCB2YWxp
ZGF0b3IgbGlzdCBieSBsb29raW5nIGF0IHRoZQpyYXcgR1VDIHN0cmluZywgd2hpY2ggZG9lcyBu
b3QgY292ZXIgYSB2YWx1ZSBtYWRlIHVwIG9mIHdoaXRlc3BhY2Ugb25seS4KU3BsaXREaXJlY3Rv
cmllc1N0cmluZygpIGFjY2VwdHMgc3VjaCBhIHZhbHVlIGFuZCBoYW5kcyBiYWNrIGFuIGVtcHR5
Cmxpc3QsIHNvIHdoZW4gdGhlIEhCQSBsaW5lIGNhcnJpZXMgbm8gdmFsaWRhdG9yPSBvcHRpb24g
dGhlIGNvZGUgd2VudCBvbgp0byByZWFkIGVsZW1saXN0LT5sZW5ndGggYW5kIGRlcmVmZXJlbmNl
ZCBOSUwuCgpFdmVyeSBlbnRyeSBwb2ludCBpbnRvIEhCQSBwYXJzaW5nIGlzIGFmZmVjdGVkLiAg
bG9hZF9oYmEoKSBydW5zIGluIHRoZQpwb3N0bWFzdGVyIGF0IHN0YXJ0dXAgYW5kIGFnYWluIG9u
IFNJR0hVUCwgc28gcmVsb2FkaW5nIGEgcnVubmluZyBzZXJ2ZXIKYnJpbmdzIHRoZSB3aG9sZSBp
bnN0YW5jZSBkb3duIGFsb25nIHdpdGggZXZlcnkgc2Vzc2lvbiBvbiBpdCwgYW5kCnBnX2hiYV9m
aWxlX3J1bGVzKCkgcGFyc2VzIHRoZSBmaWxlIGZyb20gYSByZWd1bGFyIGJhY2tlbmQsIHdoZXJl
IHRoZQpzYW1lIGNyYXNoIGZvcmNlcyBhIGNsdXN0ZXItd2lkZSByZXN0YXJ0LgoKQ2hlY2sgdGhl
IHBhcnNlIHJlc3VsdCBpbnN0ZWFkIG9mIHRoZSByYXcgc3RyaW5nLCBrZWVwaW5nIHRoZSBtZXNz
YWdlIHRoZQplbXB0eSBzZXR0aW5nIGFscmVhZHkgcHJvZHVjZWQuICBBZGQgYSB0ZXN0IHRoYXQg
cmVsb2FkcyBhIHdoaXRlc3BhY2Utb25seQpzZXR0aW5nIGFuZCB2ZXJpZmllcyB0aGF0IHRoZSBz
ZXJ2ZXIgcmVwb3J0cyB0aGUgZXJyb3IgYW5kIHN0YXlzIHVwLgotLS0KIHNyYy9iYWNrZW5kL2xp
YnBxL2F1dGgtb2F1dGguYyAgICAgICAgICAgICAgICB8IDMxICsrKysrKysrKysrLS0tLS0tLS0K
IC4uLi9tb2R1bGVzL29hdXRoX3ZhbGlkYXRvci90LzAwMV9zZXJ2ZXIucGwgICB8IDE2ICsrKysr
KysrKysKIDIgZmlsZXMgY2hhbmdlZCwgMzQgaW5zZXJ0aW9ucygrKSwgMTMgZGVsZXRpb25zKC0p
CgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEvYXV0aC1vYXV0aC5jIGIvc3JjL2JhY2tl
bmQvbGlicHEvYXV0aC1vYXV0aC5jCmluZGV4IGI3Njk5MzEuLjhkZmU1ZjkgMTAwNjQ0Ci0tLSBh
L3NyYy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYworKysgYi9zcmMvYmFja2VuZC9saWJwcS9h
dXRoLW9hdXRoLmMKQEAgLTg2MywxOSArODYzLDYgQEAgY2hlY2tfb2F1dGhfdmFsaWRhdG9yKEhi
YUxpbmUgKmhiYWxpbmUsIGludCBlbGV2ZWwsIGNoYXIgKiplcnJfbXNnKQogCiAJKmVycl9tc2cg
PSBOVUxMOwogCi0JaWYgKG9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXNfc3RyaW5nWzBdID09ICdc
MCcpCi0JewotCQllcmVwb3J0KGVsZXZlbCwKLQkJCQllcnJjb2RlKEVSUkNPREVfQ09ORklHX0ZJ
TEVfRVJST1IpLAotCQkJCWVycm1zZygicGFyYW1ldGVyIFwiJXNcIiBtdXN0IGJlIHNldCBmb3Ig
YXV0aGVudGljYXRpb24gbWV0aG9kIFwiJXNcIiIsCi0JCQkJCSAgICJvYXV0aF92YWxpZGF0b3Jf
bGlicmFyaWVzIiwgIm9hdXRoIiksCi0JCQkJZXJyY29udGV4dCgibGluZSAlZCBvZiBjb25maWd1
cmF0aW9uIGZpbGUgXCIlc1wiIiwKLQkJCQkJCSAgIGxpbmVfbnVtLCBmaWxlX25hbWUpKTsKLQkJ
KmVycl9tc2cgPSBwc3ByaW50ZigicGFyYW1ldGVyIFwiJXNcIiBtdXN0IGJlIHNldCBmb3IgYXV0
aGVudGljYXRpb24gbWV0aG9kIFwiJXNcIiIsCi0JCQkJCQkJIm9hdXRoX3ZhbGlkYXRvcl9saWJy
YXJpZXMiLCAib2F1dGgiKTsKLQkJcmV0dXJuIGZhbHNlOwotCX0KLQogCS8qIFNwbGl0RGlyZWN0
b3JpZXNTdHJpbmcgbmVlZHMgYSBtb2RpZmlhYmxlIGNvcHkgKi8KIAlyYXdzdHJpbmcgPSBwc3Ry
ZHVwKG9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXNfc3RyaW5nKTsKIApAQCAtODkxLDYgKzg3OCwy
NCBAQCBjaGVja19vYXV0aF92YWxpZGF0b3IoSGJhTGluZSAqaGJhbGluZSwgaW50IGVsZXZlbCwg
Y2hhciAqKmVycl9tc2cpCiAJCWdvdG8gZG9uZTsKIAl9CiAKKwkvKgorCSAqIEFuIGVtcHR5IG9y
IGFsbC13aGl0ZXNwYWNlIHNldHRpbmcgaXMgYWNjZXB0ZWQgYnkKKwkgKiBTcGxpdERpcmVjdG9y
aWVzU3RyaW5nKCksIHdoaWNoIHJldHVybnMgYW4gZW1wdHkgbGlzdCBmb3IgaXQsIHNvIHRoZQor
CSAqIHBhcnNlIHJlc3VsdCBoYXMgdG8gYmUgY2hlY2tlZCByYXRoZXIgdGhhbiB0aGUgcmF3IHN0
cmluZy4KKwkgKi8KKwlpZiAoZWxlbWxpc3QgPT0gTklMKQorCXsKKwkJZXJlcG9ydChlbGV2ZWws
CisJCQkJZXJyY29kZShFUlJDT0RFX0NPTkZJR19GSUxFX0VSUk9SKSwKKwkJCQllcnJtc2coInBh
cmFtZXRlciBcIiVzXCIgbXVzdCBiZSBzZXQgZm9yIGF1dGhlbnRpY2F0aW9uIG1ldGhvZCBcIiVz
XCIiLAorCQkJCQkgICAib2F1dGhfdmFsaWRhdG9yX2xpYnJhcmllcyIsICJvYXV0aCIpLAorCQkJ
CWVycmNvbnRleHQoImxpbmUgJWQgb2YgY29uZmlndXJhdGlvbiBmaWxlIFwiJXNcIiIsCisJCQkJ
CQkgICBsaW5lX251bSwgZmlsZV9uYW1lKSk7CisJCSplcnJfbXNnID0gcHNwcmludGYoInBhcmFt
ZXRlciBcIiVzXCIgbXVzdCBiZSBzZXQgZm9yIGF1dGhlbnRpY2F0aW9uIG1ldGhvZCBcIiVzXCIi
LAorCQkJCQkJCSJvYXV0aF92YWxpZGF0b3JfbGlicmFyaWVzIiwgIm9hdXRoIik7CisJCWdvdG8g
ZG9uZTsKKwl9CisKIAlpZiAoIWhiYWxpbmUtPm9hdXRoX3ZhbGlkYXRvcikKIAl7CiAJCWlmIChl
bGVtbGlzdC0+bGVuZ3RoID09IDEpCmRpZmYgLS1naXQgYS9zcmMvdGVzdC9tb2R1bGVzL29hdXRo
X3ZhbGlkYXRvci90LzAwMV9zZXJ2ZXIucGwgYi9zcmMvdGVzdC9tb2R1bGVzL29hdXRoX3ZhbGlk
YXRvci90LzAwMV9zZXJ2ZXIucGwKaW5kZXggODk0MWEzNS4uODYzMDdiZSAxMDA2NDQKLS0tIGEv
c3JjL3Rlc3QvbW9kdWxlcy9vYXV0aF92YWxpZGF0b3IvdC8wMDFfc2VydmVyLnBsCisrKyBiL3Ny
Yy90ZXN0L21vZHVsZXMvb2F1dGhfdmFsaWRhdG9yL3QvMDAxX3NlcnZlci5wbApAQCAtMTIwLDYg
KzEyMCwyMiBAQCBsb2NhbCBhbGwgdGVzdHBhcmFtIG9hdXRoIGlzc3Vlcj0iJGlzc3Vlci9wYXJh
bSIgc2NvcGU9Im9wZW5pZCBwb3N0Z3JlcyIKIH0pOwogJG5vZGUtPnJlbG9hZDsKIAorJGxvZ19z
dGFydCA9CisgICRub2RlLT53YWl0X2Zvcl9sb2cocXIvcmVsb2FkaW5nIGNvbmZpZ3VyYXRpb24g
ZmlsZXMvLCAkbG9nX3N0YXJ0KTsKKworIyBBbiBhbGwtd2hpdGVzcGFjZSBsaWJyYXJ5IGxpc3Qg
cGFyc2VzIGFzIGFuIGVtcHR5IGxpc3QuICBSZWplY3QgaXQgd2l0aG91dAorIyBjcmFzaGluZyB0
aGUgcG9zdG1hc3RlciBkdXJpbmcgSEJBIHJlbG9hZC4KKyRub2RlLT5hcHBlbmRfY29uZigncG9z
dGdyZXNxbC5jb25mJywKKwkib2F1dGhfdmFsaWRhdG9yX2xpYnJhcmllcyA9ICcgICAnXG4iKTsK
KyRub2RlLT5yZWxvYWQ7CiskbG9nX3N0YXJ0ID0gJG5vZGUtPndhaXRfZm9yX2xvZygKKwlxci9w
YXJhbWV0ZXIgIm9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXMiIG11c3QgYmUgc2V0LywgJGxvZ19z
dGFydCk7CitpcygkYmdjb25uLT5xdWVyeV9zYWZlKCdTRUxFQ1QgMScpLCAnMScsCisJJ3Bvc3Rt
YXN0ZXIgc3Vydml2ZXMgYW4gZW1wdHkgT0F1dGggdmFsaWRhdG9yIGxpc3Qgb24gcmVsb2FkJyk7
CisKKyRub2RlLT5hcHBlbmRfY29uZigncG9zdGdyZXNxbC5jb25mJywKKwkib2F1dGhfdmFsaWRh
dG9yX2xpYnJhcmllcyA9ICd2YWxpZGF0b3InXG4iKTsKKyRub2RlLT5yZWxvYWQ7CiAkbG9nX3N0
YXJ0ID0KICAgJG5vZGUtPndhaXRfZm9yX2xvZyhxci9yZWxvYWRpbmcgY29uZmlndXJhdGlvbiBm
aWxlcy8sICRsb2dfc3RhcnQpOwogCi0tIAoyLjM5LjUgKEFwcGxlIEdpdC0xNTQpCgo=

--_002_04fa84f6ebbe400f940e179ebe1070e9ftdataru_--