Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19613: pg_restore: several SEGVs in ReadToc() in
 pg_backup_archiver.c
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: ilia.kashintsev@gmail.com
Reply-To: ilia.kashintsev@gmail.com, pgsql-bugs@lists.postgresql.org
Date: Fri, 07 Aug 2026 13:37:25 +0000
Message-ID: <19613-3a9ffc23ee402382@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19613-3a9ffc23ee402382%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19613
Logged by:          Ilia Kashintsev
Email address:      ilia.kashintsev@gmail.com
PostgreSQL version: 19beta2
Operating system:   Ubuntu 24.04.4 LTS
Description:       =20

Hello maintainers!
I have found several SEGVs on unknown address in ReadToc().

They occur because return value of numerous ReadStr(AH) calls is never
checked, with sscanf() or strcmp() being called on tmp =3D=3D NULL.

For example pg_backup_archiver:2738-2739:

                        tmp =3D ReadStr(AH);
                        sscanf(tmp, "%u", &te->catalogId.tableoid); <------

Steps to reproduce:

1) Build the project with ASAN;
sudo mkdir -p /builds2
sudo chown "$(whoami)" /builds2

mkdir -p asan_build
cd asan_build
export CC=3Dclang
export CXX=3Dclang++
export CFLAGS=3D"-O1 -g -fsanitize=3Daddress -fno-omit-frame-pointer"
export CXXFLAGS=3D"-O1 -g -fsanitize=3Daddress -fno-omit-frame-pointer"
export LDFLAGS=3D"-fsanitize=3Daddress"

../postgres/configure --prefix=3D/builds2/pg-asan
make -j
sudo make install

2) Run the example:

echo 'UEdETVABDDABMAEwMDAwMDAwMDAwMDAwMDAwMDAwMDAwADAAMDAwMDA=3D' | base64 =
-d
> inp.bin
/builds2/pg-asan/bin/pg_restore -f dump.sql inp.bin

Sanitizer output:
AddressSanitizer:DEADLYSIGNAL
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D247028=3D=3DERROR: AddressSanitizer: SEGV on unknown address 0x000000=
000000
(pc 0x778e90f7995d bp 0x7ffe3361c840 sp 0x7ffe3361c818 T0)
=3D=3D247028=3D=3DThe signal is caused by a READ memory access.
=3D=3D247028=3D=3DHint: address points to the zero page.
    #0 0x778e90f7995d in __strlen_avx2
string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
    #1 0x778e90e853d4 in _IO_str_init_static_internal libio/strops.c:41:11
    #2 0x778e90e4dd10 in _IO_strfile_read
stdio-common/../libio/strfile.h:90:3
    #3 0x778e90e4dd10 in __isoc23_vsscanf
stdio-common/isoc23_vsscanf.c:24:13
    #4 0x62420175134d in __isoc23_sscanf
(/builds2/pg-asan/bin/pg_restore+0x6734d) (BuildId:
b947abf32a751f35042d5aa2948e2318357a75a0)
    #5 0x62420182553e in ReadToc
/home/reproduce/asan_build/../postgres/src/bin/pg_dump/pg_backup_archiver.c=
:2739:4
    #6 0x62420182c929 in InitArchiveFmt_Custom
/home/reproduce/asan_build/../postgres/src/bin/pg_dump/pg_backup_custom.c:1=
80:3
    #7 0x6242018164f1 in _allocAH
/home/reproduce/asan_build/../postgres/src/bin/pg_dump/pg_backup_archiver.c=
:2470:4
    #8 0x624201816b1e in OpenArchive
/home/reproduce/asan_build/../postgres/src/bin/pg_dump/pg_backup_archiver.c=
:254:7
    #9 0x624201807641 in main
/home/reproduce/asan_build/../postgres/src/bin/pg_dump/pg_restore.c:488:7
    #10 0x778e90e181c9 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x778e90e1828a in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x62420172c984 in _start (/builds2/pg-asan/bin/pg_restore+0x42984)
(BuildId: b947abf32a751f35042d5aa2948e2318357a75a0)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76 in __strlen_avx2
=3D=3D247028=3D=3DABORTING


Suggested fix:
Checking the return value of ReadStr resolves the issue.

diff --git a/src/bin/pg_dump/pg_backup_archiver.c
b/src/bin/pg_dump/pg_backup_archiver.c
index d7da3fc..3e9ac90 100644
--- a/src/bin/pg_dump/pg_backup_archiver.c
+++ b/src/bin/pg_dump/pg_backup_archiver.c
@@ -2736,18 +2736,26 @@ ReadToc(ArchiveHandle *AH)
                if (AH->version >=3D K_VERS_1_8)
                {
                        tmp =3D ReadStr(AH);
+                       if (tmp =3D=3D NULL)
+                               pg_fatal("corrupt TOC: missing tableoid");
                        sscanf(tmp, "%u", &te->catalogId.tableoid);
                        free(tmp);
                }
                else
                        te->catalogId.tableoid =3D InvalidOid;
                tmp =3D ReadStr(AH);
+               if (tmp =3D=3D NULL)
+                       pg_fatal("corrupt TOC: missing oid");
                sscanf(tmp, "%u", &te->catalogId.oid);
                free(tmp);

                te->tag =3D ReadStr(AH);
-               te->desc =3D ReadStr(AH);
+               if (te->tag =3D=3D NULL)
+                       pg_fatal("corrupt TOC: missing entry tag");

+               te->desc =3D ReadStr(AH);
+               if (te->desc =3D=3D NULL)
+                       pg_fatal("corrupt TOC: missing entry description");
                if (AH->version >=3D K_VERS_1_11)
                {
                        te->section =3D ReadInt(AH);
@@ -2804,6 +2812,8 @@ ReadToc(ArchiveHandle *AH)
                {
                        tmp =3D ReadStr(AH);

+                       if (tmp =3D=3D NULL)
+                               pg_fatal("corrupt TOC: missing WITH OIDS
marker");
                        if (strcmp(tmp, "true") =3D=3D 0)
                                is_supported =3D false;