Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1wXT4M-003HcH-0l
	for pgsql-bugs@arkaria.postgresql.org;
	Thu, 11 Jun 2026 00:14:50 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1wXT4L-00DZfR-0f
	for pgsql-bugs@arkaria.postgresql.org;
	Thu, 11 Jun 2026 00:14:49 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <andrey.cherny@tantorlabs.com>)
	id 1wXT4K-00DZfI-34
	for pgsql-bugs@lists.postgresql.org;
	Thu, 11 Jun 2026 00:14:48 +0000
Received: from forward100b.mail.yandex.net ([178.154.239.147])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <andrey.cherny@tantorlabs.com>)
	id 1wXT4H-000000025rq-0bYU
	for pgsql-bugs@lists.postgresql.org;
	Thu, 11 Jun 2026 00:14:48 +0000
Received: from mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net
 (mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net
 [IPv6:2a02:6b8:c0c:1e05:0:640:3290:0])
	by forward100b.mail.yandex.net (Yandex) with ESMTPS id 08BF280CAA;
	Thu, 11 Jun 2026 03:14:39 +0300 (MSK)
Received: by mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net (smtp)
 with ESMTPSA id bE8MWICgXeA0-I4saXAYx;
	Thu, 11 Jun 2026 03:14:38 +0300
X-Yandex-Fwd: 1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tantorlabs.com;
	s=mail; t=1781136878;
	bh=kOAp1T8efQFnoXuxH5T5DjMmlFyEDl4q9VM3wRScVLU=;
	h=Message-ID:Subject:To:From:Cc:Date;
	b=hUZeFS7/SWZI0SQNWfRY3TNFVdVQ7rVVsnQDZlRnQkI0MDOIVu6E2adyuXPsc1M+1
	 YscCneCkIBPYoUffdB0LoTrMbKbUoSO4DmJCr1Kc/b3IOaVDmdzgF3CGBp6/X6AZyA
	 +IbAIHyLV6jyM/XQ0hM4AjUJ4C/mPRgXOO3UHRAE=
Authentication-Results: 
 mail-nwsmtp-smtp-production-main-59.iva.yp-c.yandex.net;
 dkim=pass header.i=@tantorlabs.com
Date: Thu, 11 Jun 2026 03:14:36 +0300
From: Andrey Chernyy <andrey.cherny@tantorlabs.com>
To: pgsql-bugs@lists.postgresql.org
Cc: Michael Paquier <michael@paquier.xyz>
Subject: [PATCH] contrib/xml2: backend crash in xpath_nodeset() on the
 namespace axis
Message-ID: <20260611031436.5afde3cb@andrnote>
X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-redhat-linux-gnu)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="MP_/QSClNE9NwyljXO+PMF4CHMj"
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/20260611031436.5afde3cb%40andrnote>
Precedence: bulk

--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

In the xml2 extension, xpath_nodeset() crashes the backend on an XPath
that selects namespace-axis nodes.  xpath_nodeset() is executable by
PUBLIC by default, so any role that can run SQL can crash the server
with one query:

    CREATE EXTENSION xml2;
    SELECT xpath_nodeset('<root
    xmlns:foo="http://example.com/foo"><child/></root>',
    '//namespace::*');

Cause: pgxmlNodeSetToText() (contrib/xml2/xpath.c:197) calls

    xmlNodeDump(buf, nodeset->nodeTab[i]->doc, nodeset->nodeTab[i], 1,
    0);

with no node-type check.  Namespace-axis results are XML_NAMESPACE_DECL
nodes (xmlNs structs cast to xmlNodePtr), so reading the node's ->doc
field runs past the smaller xmlNs allocation, and the bogus value is
then dereferenced as the document by xmlNodeDump().  xpath_list() and
xpath_table() already avoid this via xmlXPathCastNodeToString(); only
the xmlNodeDump() path is exposed.

Reproduced on master; the same unguarded xmlNodeDump() call in
pgxmlNodeSetToText() is present on every supported back-branch (REL_18
through REL_14).

Patch attached: render XML_NAMESPACE_DECL nodes with
xmlXPathCastNodeToString() like xpath_table() does.  The repro then
returns the namespace text, ordinary node-set output is unchanged, and
the xml2 regression test passes.

--
Andrey Chernyy

--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: text/x-patch
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename=0001-xml2-fix-crash-on-namespace-nodes-in-xpath_nodeset.patch