From: Tom Lane <tgl@sss.pgh.pa.us>
To: Erik Wienhold <ewie@ewie.name>
cc: fuboat@outlook.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18617: PostgreSQL Server Subprocess Crashes by the XPATH
 Function Expression with Crafted Arguments
In-reply-to: <107366.1726246563@sss.pgh.pa.us>
References: <18617-1cee4d2ed1f4e7ae@postgresql.org>
 <08a0ba98-2dec-4773-8bfd-9eaced528372@ewie.name>
 <104996.1726245143@sss.pgh.pa.us> <107366.1726246563@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Fri, 13 Sep 2024 12:56:03 -0400"
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0"
Content-ID: <160276.1726271747.0@sss.pgh.pa.us>
Date: Fri, 13 Sep 2024 19:57:04 -0400
Message-ID: <160394.1726271824@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/160394.1726271824%40sss.pgh.pa.us>
Precedence: bulk

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <160276.1726271747.1@sss.pgh.pa.us>

I wrote:
> I filed a new report at
> https://gitlab.gnome.org/GNOME/libxml2/-/issues/799

Based on Nick Wellnhofer's response there, I've experimented with the
attached WIP patch, and it does seem to prevent the problem as long as
you have a non-ancient libxml2.  This is only WIP because there are
other xmlXPathCompile calls we'd have to fix.

Sadly, still-popular distros like RHEL8 have "ancient" libxml2
versions, but that means they're exposed to the original bug not
only this variant.  It seems to me to be worth masking the bug
where we can, though.

Nick also suggested that we not bother with a separate xmlXPathCompile
call if we're just going to throw away the compiled expression after
one use.  Perhaps that's good cleanup, not sure.  I don't know if
anyone has serious ambitions of re-using the compiled XPath
expressions.

			regards, tom lane


------- =_aaaaaaaaaa0
Content-Type: text/x-diff; name="libxml2-stack-overrun-fix-wip.patch";
	charset="us-ascii"
Content-ID: <160276.1726271747.2@sss.pgh.pa.us>
Content-Description: libxml2-stack-overrun-fix-wip.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
index 1a07876cd5..37e0cabe60 100644
--- a/src/backend/utils/adt/xml.c
+++ b/src/backend/utils/adt/xml.c
@@ -4448,7 +4448,7 @@ xpath_internal(text *xpath_expr_text, xmltype *data,=
 ArrayType *namespaces,
 			}
 		}
 =

-		xpathcomp =3D xmlXPathCompile(xpath_expr);
+		xpathcomp =3D xmlXPathCtxtCompile(xpathctx, xpath_expr);
 		if (xpathcomp =3D=3D NULL || xmlerrcxt->err_occurred)
 			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INTERNAL_ERROR,
 						"invalid XPath expression");

------- =_aaaaaaaaaa0--