agora inbox for pgsql-bugs@postgresql.org  

help / color / mirror / Atom feed

From: Andrey Chernyy <andrey.cherny@tantorlabs.com>
To: pgsql-bugs@lists.postgresql.org
Cc: Michael Paquier <michael@paquier.xyz>
Subject: [PATCH] contrib/xml2: backend crash in xpath_nodeset() on the namespace axis
Date: Thu, 11 Jun 2026 03:14:36 +0300
Message-ID: <20260611031436.5afde3cb@andrnote> (raw)

Hi,

In the xml2 extension, xpath_nodeset() crashes the backend on an XPath
that selects namespace-axis nodes.  xpath_nodeset() is executable by
PUBLIC by default, so any role that can run SQL can crash the server
with one query:

    CREATE EXTENSION xml2;
    SELECT xpath_nodeset('<root
    xmlns:foo="http://example.com/foo"><child/></root>';,
    '//namespace::*');

Cause: pgxmlNodeSetToText() (contrib/xml2/xpath.c:197) calls

    xmlNodeDump(buf, nodeset->nodeTab[i]->doc, nodeset->nodeTab[i], 1,
    0);

with no node-type check.  Namespace-axis results are XML_NAMESPACE_DECL
nodes (xmlNs structs cast to xmlNodePtr), so reading the node's ->doc
field runs past the smaller xmlNs allocation, and the bogus value is
then dereferenced as the document by xmlNodeDump().  xpath_list() and
xpath_table() already avoid this via xmlXPathCastNodeToString(); only
the xmlNodeDump() path is exposed.

Reproduced on master; the same unguarded xmlNodeDump() call in
pgxmlNodeSetToText() is present on every supported back-branch (REL_18
through REL_14).

Patch attached: render XML_NAMESPACE_DECL nodes with
xmlXPathCastNodeToString() like xpath_table() does.  The repro then
returns the namespace text, ordinary node-set output is unchanged, and
the xml2 regression test passes.

--
Andrey Chernyy

Attachments:

  [text/x-patch] 0001-xml2-fix-crash-on-namespace-nodes-in-xpath_nodeset.patch (0B, ../20260611031436.5afde3cb@andrnote/2-0001-xml2-fix-crash-on-namespace-nodes-in-xpath_nodeset.patch)
  download

view thread (4+ messages)  latest in thread

Message-ID: <20260611031436.5afde3cb@andrnote>
Permalink:  ../20260611031436.5afde3cb@andrnote/
Also on:    postgresql.org/message-id/20260611031436.5afde3cb@andrnote

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: andrey.cherny@tantorlabs.com, pgsql-bugs@lists.postgresql.org, michael@paquier.xyz
  Subject: Re: [PATCH] contrib/xml2: backend crash in xpath_nodeset() on the namespace axis
  In-Reply-To: <20260611031436.5afde3cb@andrnote>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox