Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19612: SEGV in ParseConfigFp() in guc-file.l
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: ilia.kashintsev@gmail.com
Reply-To: ilia.kashintsev@gmail.com, pgsql-bugs@lists.postgresql.org
Date: Fri, 07 Aug 2026 13:32:09 +0000
Message-ID: <19612-24ccb4fc6da7786f@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19612-24ccb4fc6da7786f%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19612
Logged by:          Ilia Kashintsev
Email address:      ilia.kashintsev@gmail.com
PostgreSQL version: 19beta2
Operating system:   Ubuntu 24.04.4 LTS
Description:       =20

Hello maintainers!
I have found a SEGV on unknown address in ParseConfigFp().

The error itself is caused by passing a directory to the "include"
statement in the configuration file. The current checks do not account
for such error, so the first reading attempt occurring via
"while ((token =3D yylex(scanner)))" -> yy_get_next_buffer -> YY_INPUT
results in a fatal Flex error. After that execution goes to the
cleanup, and the state is not "sane enough for yy_delete_buffer()",
resulting in a crash on dereferences in YY_CURRENT_BUFFER.

Steps to reproduce:

1) Build the project with ASAN;
sudo mkdir -p /builds2
sudo chown "$(whoami)" /builds2

mkdir -p asan_build
cd asan_build
export CC=3Dclang
export CXX=3Dclang++
export CFLAGS=3D"-O1 -g -fsanitize=3Daddress -fno-omit-frame-pointer"
export CXXFLAGS=3D"-O1 -g -fsanitize=3Daddress -fno-omit-frame-pointer"
export LDFLAGS=3D"-fsanitize=3Daddress"

../postgres/configure --prefix=3D/builds2/pg-asan
make -j
sudo make install

2) Run with the example config:

echo "include 'directory'" > error.conf
mkdir directory
/builds2/pg-asan/bin/postgres -c config_file=3D./error.conf

Sanitizer output:
2026-08-06 11:47:13.488 GMT [219826] LOG:  input in flex scanner failed at
file "/home/reproduce/asan_build/directory" line 1
AddressSanitizer:DEADLYSIGNAL
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D219826=3D=3DERROR: AddressSanitizer: SEGV on unknown address (pc
0x62a2e32967a3 bp 0x7ffc3751ed70 sp 0x7ffc3751eb20 T0)
=3D=3D219826=3D=3DThe signal is caused by a READ memory access.
=3D=3D219826=3D=3DHint: this fault was caused by a dereference of a high va=
lue
address (see register values below).  Disassemble the provided pc to learn
which register was used.
    #0 0x62a2e32967a3 in GUC_yy_delete_buffer
/home/reproduce/asan_build/src/backend/utils/misc/guc-file.c:1631:12
    #1 0x62a2e32967a3 in ParseConfigFp
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc-file.l:56=
2:2
    #2 0x62a2e3294d6e in ParseConfigFile
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc-file.l:26=
3:7
    #3 0x62a2e3296463 in ParseConfigFp
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc-file.l:47=
3:9
    #4 0x62a2e3294d6e in ParseConfigFile
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc-file.l:26=
3:7
    #5 0x62a2e3277058 in ProcessConfigFileInternal
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc.c:299:7
    #6 0x62a2e3294b16 in ProcessConfigFile
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc-file.l:15=
3:9
    #7 0x62a2e327b0f0 in SelectConfigFiles
/home/reproduce/asan_build/../postgres/src/backend/utils/misc/guc.c:1733:2
    #8 0x62a2e2ccebcc in PostmasterMain
/home/reproduce/asan_build/../postgres/src/backend/postmaster/postmaster.c:=
790:7
    #9 0x62a2e2a01831 in main
/home/reproduce/asan_build/../postgres/src/backend/main/main.c:231:4
    #10 0x73e7983d71c9 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x73e7983d728a in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x62a2e22c9ef4 in _start (/builds2/pg-asan/bin/postgres+0x381ef4)
(BuildId: 8022979c2ccf668e43e16c68d221ad47bf314c32)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/reproduce/asan_build/src/backend/utils/misc/guc-file.c:1631:12 in
GUC_yy_delete_buffer
=3D=3D219826=3D=3DABORTING

Suggested fix:
Probably could be done more elegantly,
but a check for a directory resolves the issue:

diff --git a/src/backend/utils/misc/guc-file.l
b/src/backend/utils/misc/guc-file.l
index 58669a6..e6c810a 100644
--- a/src/backend/utils/misc/guc-file.l
+++ b/src/backend/utils/misc/guc-file.l
@@ -10,6 +10,7 @@
 #include "postgres.h"

 #include <ctype.h>
+#include <sys/stat.h>
 #include <unistd.h>

 #include "common/file_utils.h"
@@ -237,6 +238,18 @@ ParseConfigFile(const char *config_file, bool strict,
        }

        fp =3D AllocateFile(abs_path, "r");
+       if (fp)
+       {
+               struct stat st;
+
+               if (fstat(fileno(fp), &st) =3D=3D 0 && S_ISDIR(st.st_mode))
+               {
+                       FreeFile(fp);
+                       fp =3D NULL;
+                       errno =3D EISDIR;
+               }
+       }
+
        if (!fp)
        {
                if (strict)