From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: 13952878799@163.com
Subject: BUG #19092: scram_free() will free on address which was not malloc()-ed in pg_scram_mech
Date: Tue, 21 Oct 2025 07:43:58 +0000
Message-ID: <19092-b06adfd70ddcd2ab@postgresql.org> (raw)
The following bug has been logged on the website:
Bug reference: 19092
Logged by: NJUEEXRM
Email address: 13952878799@163.com
PostgreSQL version: 17.0
Operating system: MacOS 12.7.6
Description:
The issue is about the only implementation of pg_fe_sasl_mech interface:
pg_scram_mech. In the init func of pg_scram_mech, the variable
state->password is assigned by variable prep_password, which is prepared in
function pg_saslprep(). However, pg_saslprep() will use palloc/pfree or
malloc/free determined by FRONTEND marco。If we are in backend env，the
prep_password will be palloc-ed in CurrentMemoryContext. The problem is
state->password will be released by free() in the free func of
pg_scram_mech: scram_free, and will cause 'free on address which was not
malloc()-ed' error.
This issue occurred when I was attempting to make a connection to Backend
via libpq interfaces in Backend itself.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, 13952878799@163.com
Subject: Re: BUG #19092: scram_free() will free on address which was not malloc()-ed in pg_scram_mech
In-Reply-To: <19092-b06adfd70ddcd2ab@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox