From: Tom Lane <tgl@sss.pgh.pa.us>
To: 3020001251@tju.edu.cn
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19527: Double-Abort Crash in `ResOwnerReleaseOSSLCipher` via
 `encrypt_iv` with Oversized Input
In-reply-to: <19527-6e7686960c6dce78@postgresql.org>
References: <19527-6e7686960c6dce78@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Thu, 18 Jun 2026 18:17:12 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <484821.1782146253.1@sss.pgh.pa.us>
Date: Mon, 22 Jun 2026 12:37:33 -0400
Message-ID: <484822.1782146253@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/484822.1782146253%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> Any role with `EXECUTE` on `encrypt_iv` (granted by default when pgcrypto is
> installed) can crash the backend with a single statement:

> ```sql
> CREATE EXTENSION IF NOT EXISTS pgcrypto;
> SELECT encrypt_iv(
>     repeat('A', 1073741308)::bytea,
>     decode('00112233445566778899aabbccddeeff', 'hex'),
>     decode('000102030405060708090a0b0c0d0e0f', 'hex'),
>     'aes'
> );
> ```

> The fix is to clear `od->owner` before calling `free_openssl_cipher` in
> `ResOwnerReleaseOSSLCipher`:

Good catch, thanks for the report!

			regards, tom lane