MIME-Version: 1.0
References: <19511-f9f251767b658232@postgresql.org>
In-Reply-To: <19511-f9f251767b658232@postgresql.org>
From: Amjad Shahzad <amjadshahzad2000@gmail.com>
Date: Fri, 5 Jun 2026 06:19:48 +0500
Message-ID: 
 <CADHzGZRAxFYoxMC+g6pEJ0FL0bfVhFi+y0jQ0cRNCC5hFjvJ3Q@mail.gmail.com>
Subject: Re: BUG #19511: contrib/dblink: NULL dereference in
 dblink_get_notify() when called without a prior connection
To: amjadshahzad2000@gmail.com, pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="00000000000003840c06537776e3"
Archived-At: 
 <https://www.postgresql.org/message-id/CADHzGZRAxFYoxMC%2Bg6pEJ0FL0bfVhFi%2By0jQ0cRNCC5hFjvJ3Q%40mail.gmail.com>
Precedence: bulk

--00000000000003840c06537776e3
Content-Type: multipart/alternative; boundary="00000000000003840b06537776e1"

--00000000000003840b06537776e1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi

This was originally reported to security@postgresql.org, redirected here by
the security team as this does not meet the security
vulnerability threshold.

Patch attached. Applies cleanly against master 0392fb900eb.
Adds the same NULL guard used by every other function in dblink.c that
accesses the default connection.

Regards
Amjad

On Fri, Jun 5, 2026 at 6:16=E2=80=AFAM PG Bug reporting form <noreply@postg=
resql.org>
wrote:

> The following bug has been logged on the website:
>
> Bug reference:      19511
> Logged by:          Amjad Shahzad
> Email address:      amjadshahzad2000@gmail.com
> PostgreSQL version: 18.4
> Operating system:   Ubuntu 24.04 x86_64
> Description:
>
> I found a NULL pointer dereference in contrib/dblink/dblink.c in the
> dblink_get_notify() function. Any user with EXECUTE on the function
> can crash their backend process with a single call. Confirmed against
> master
> commit 0392fb900eb.
>
> WHAT IS THE ISSUE
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> dblink_get_notify() retrieves async notifications from a remote connectio=
n.
> When called with no arguments it uses the default
> (unnamed) connection. If no default connection has been established first=
,
> pconn->conn is NULL. The code assigns this NULL to conn and
> then passes it directly to PQconsumeInput() and PQnotifies():
>
>     /* line 1893 (master) */
>     else
>         conn =3D pconn->conn;      /* NULL =E2=80=94 no connection establ=
ished */
>
>     InitMaterializedSRF(fcinfo, 0);
>
>     PQconsumeInput(conn);        /* passes NULL to libpq */
>     while ((notify =3D PQnotifies(conn)) !=3D NULL)  /* NULL dereference =
*/
>
> PQnotifies(NULL) dereferences a null pointer internally, causing a backen=
d
> SIGSEGV.
>
> Every other function in dblink.c that uses the default connection already
> has an explicit NULL guard:
>
>     if (!conn)
>         dblink_conn_not_avail(conname);
>
> dblink_get_notify() is the only function that skips this guard.
>
> WHAT CAN BE COMPROMISED
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
> Any user with EXECUTE on dblink_get_notify(), granted to PUBLIC by defaul=
t
> can crash their backend process
> on demand. No password, no connection, no special privileges required.
>
> In a shared server environment this can be used as a denial-of-service
> against a specific session. Combined with
> connection pooling or persistent connections it could repeatedly crash
> backend processes.
>
> PREREQUISITES
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>   1. Any connected database user
>   2. EXECUTE on dblink_get_notify (granted to PUBLIC by default)
>   3. contrib/dblink installed (CREATE EXTENSION dblink)
>
> No dblink connection needed. No password needed.
>
> STEPS TO REPRODUCE
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>     -- STEP 1: Install dblink
>     CREATE EXTENSION dblink;
>
>     -- STEP 2: As any user, call without connecting first
>     SELECT * FROM dblink_get_notify();
>
>     -- Result before fix:
>     -- server closed the connection unexpectedly
>     -- SIGSEGV in server log
>
>     -- Result after fix:
>     -- ERROR:  connection not available
>
> THE FIX
> =3D=3D=3D=3D=3D=3D=3D
> Add the same NULL guard that every other dblink function already has:
>
>     /* BEFORE */
>     else
>         conn =3D pconn->conn;
>
>     /* AFTER */
>     else
>     {
>         conn =3D pconn->conn;
>         if (!conn)
>             dblink_conn_not_avail(NULL);
>     }
>
> 4 lines added. Patch attached.
>
> BEHAVIOUR AFTER THE FIX
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>     -- No prior connection:
>     SELECT * FROM dblink_get_notify();
>     -- ERROR:  connection not available   (clean error, no crash)
>
>     -- With valid connection:
>     SELECT * FROM dblink_get_notify('myconn');
>     -- (0 rows)   (works exactly as before)
>
> REGRESSION TEST RESULTS
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
>     $ meson test --suite dblink
>     1/2 dblink - postgresql:dblink/regress        OK  (all SQL tests pass=
)
>     2/2 dblink - postgresql:dblink/001_auth_scram OK  12 subtests passed
>     Ok: 2   Fail: 0
>
>     $ meson test --suite regress
>     1/1 regress - postgresql:regress/regress OK   245 subtests passed
>     Ok: 1   Fail: 0
>
> Tested on: PostgreSQL master 0392fb900eb, Ubuntu 24.04, x86_64.
>
>
>

--00000000000003840b06537776e1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi=C2=A0<div><br><div>This was originally reported to <a h=
ref=3D"mailto:security@postgresql.org">security@postgresql.org</a>, redirec=
ted here by the security team as this does not meet the security</div>vulne=
rability threshold.<div><br></div><div>Patch attached. Applies cleanly agai=
nst master 0392fb900eb.<br>Adds the same NULL guard used by every other fun=
ction in dblink.c that accesses the default connection.<br><br></div><div>R=
egards</div><div>Amjad</div><div></div></div></div><br><div class=3D"gmail_=
quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, =
Jun 5, 2026 at 6:16=E2=80=AFAM PG Bug reporting form &lt;<a href=3D"mailto:=
noreply@postgresql.org">noreply@postgresql.org</a>&gt; wrote:<br></div><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left=
:1px solid rgb(204,204,204);padding-left:1ex">The following bug has been lo=
gged on the website:<br>
<br>
Bug reference:=C2=A0 =C2=A0 =C2=A0 19511<br>
Logged by:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Amjad Shahzad<br>
Email address:=C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:amjadshahzad2000@gmail=
.com" target=3D"_blank">amjadshahzad2000@gmail.com</a><br>
PostgreSQL version: 18.4<br>
Operating system:=C2=A0 =C2=A0Ubuntu 24.04 x86_64<br>
Description:=C2=A0 =C2=A0 =C2=A0 =C2=A0 <br>
<br>
I found a NULL pointer dereference in contrib/dblink/dblink.c in the<br>
dblink_get_notify() function. Any user with EXECUTE on the function<br>
can crash their backend process with a single call. Confirmed against maste=
r<br>
commit 0392fb900eb.<br>
<br>
WHAT IS THE ISSUE<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
dblink_get_notify() retrieves async notifications from a remote connection.=
<br>
When called with no arguments it uses the default<br>
(unnamed) connection. If no default connection has been established first,<=
br>
pconn-&gt;conn is NULL. The code assigns this NULL to conn and<br>
then passes it directly to PQconsumeInput() and PQnotifies():<br>
<br>
=C2=A0 =C2=A0 /* line 1893 (master) */<br>
=C2=A0 =C2=A0 else<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 conn =3D pconn-&gt;conn;=C2=A0 =C2=A0 =C2=A0 /*=
 NULL =E2=80=94 no connection established */<br>
<br>
=C2=A0 =C2=A0 InitMaterializedSRF(fcinfo, 0);<br>
<br>
=C2=A0 =C2=A0 PQconsumeInput(conn);=C2=A0 =C2=A0 =C2=A0 =C2=A0 /* passes NU=
LL to libpq */<br>
=C2=A0 =C2=A0 while ((notify =3D PQnotifies(conn)) !=3D NULL)=C2=A0 /* NULL=
 dereference */<br>
<br>
PQnotifies(NULL) dereferences a null pointer internally, causing a backend<=
br>
SIGSEGV.<br>
<br>
Every other function in dblink.c that uses the default connection already<b=
r>
has an explicit NULL guard:<br>
<br>
=C2=A0 =C2=A0 if (!conn)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 dblink_conn_not_avail(conname);<br>
<br>
dblink_get_notify() is the only function that skips this guard.<br>
<br>
WHAT CAN BE COMPROMISED<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
<br>
Any user with EXECUTE on dblink_get_notify(), granted to PUBLIC by default<=
br>
can crash their backend process<br>
on demand. No password, no connection, no special privileges required.<br>
<br>
In a shared server environment this can be used as a denial-of-service<br>
against a specific session. Combined with<br>
connection pooling or persistent connections it could repeatedly crash<br>
backend processes.<br>
<br>
PREREQUISITES<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
=C2=A0 1. Any connected database user<br>
=C2=A0 2. EXECUTE on dblink_get_notify (granted to PUBLIC by default)<br>
=C2=A0 3. contrib/dblink installed (CREATE EXTENSION dblink)<br>
<br>
No dblink connection needed. No password needed.<br>
<br>
STEPS TO REPRODUCE<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
=C2=A0 =C2=A0 -- STEP 1: Install dblink<br>
=C2=A0 =C2=A0 CREATE EXTENSION dblink;<br>
<br>
=C2=A0 =C2=A0 -- STEP 2: As any user, call without connecting first<br>
=C2=A0 =C2=A0 SELECT * FROM dblink_get_notify();<br>
<br>
=C2=A0 =C2=A0 -- Result before fix:<br>
=C2=A0 =C2=A0 -- server closed the connection unexpectedly<br>
=C2=A0 =C2=A0 -- SIGSEGV in server log<br>
<br>
=C2=A0 =C2=A0 -- Result after fix:<br>
=C2=A0 =C2=A0 -- ERROR:=C2=A0 connection not available<br>
<br>
THE FIX<br>
=3D=3D=3D=3D=3D=3D=3D<br>
Add the same NULL guard that every other dblink function already has:<br>
<br>
=C2=A0 =C2=A0 /* BEFORE */<br>
=C2=A0 =C2=A0 else<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 conn =3D pconn-&gt;conn;<br>
<br>
=C2=A0 =C2=A0 /* AFTER */<br>
=C2=A0 =C2=A0 else<br>
=C2=A0 =C2=A0 {<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 conn =3D pconn-&gt;conn;<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (!conn)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 dblink_conn_not_avail(NULL);<br>
=C2=A0 =C2=A0 }<br>
<br>
4 lines added. Patch attached.<br>
<br>
BEHAVIOUR AFTER THE FIX<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br=
>
=C2=A0 =C2=A0 -- No prior connection:<br>
=C2=A0 =C2=A0 SELECT * FROM dblink_get_notify();<br>
=C2=A0 =C2=A0 -- ERROR:=C2=A0 connection not available=C2=A0 =C2=A0(clean e=
rror, no crash)<br>
<br>
=C2=A0 =C2=A0 -- With valid connection:<br>
=C2=A0 =C2=A0 SELECT * FROM dblink_get_notify(&#39;myconn&#39;);<br>
=C2=A0 =C2=A0 -- (0 rows)=C2=A0 =C2=A0(works exactly as before)<br>
<br>
REGRESSION TEST RESULTS<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
<br>
=C2=A0 =C2=A0 $ meson test --suite dblink<br>
=C2=A0 =C2=A0 1/2 dblink - postgresql:dblink/regress=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 OK=C2=A0 (all SQL tests pass)<br>
=C2=A0 =C2=A0 2/2 dblink - postgresql:dblink/001_auth_scram OK=C2=A0 12 sub=
tests passed<br>
=C2=A0 =C2=A0 Ok: 2=C2=A0 =C2=A0Fail: 0<br>
<br>
=C2=A0 =C2=A0 $ meson test --suite regress<br>
=C2=A0 =C2=A0 1/1 regress - postgresql:regress/regress OK=C2=A0 =C2=A0245 s=
ubtests passed<br>
=C2=A0 =C2=A0 Ok: 1=C2=A0 =C2=A0Fail: 0<br>
<br>
Tested on: PostgreSQL master 0392fb900eb, Ubuntu 24.04, x86_64.<br>
<br>
<br>
</blockquote></div>

--00000000000003840b06537776e1--

--00000000000003840c06537776e3
Content-Type: application/octet-stream;
	name="v1-fix-dblink-get-notify-null-crash.patch"
Content-Disposition: attachment;
	filename="v1-fix-dblink-get-notify-null-crash.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mq08j58i0>
X-Attachment-Id: f_mq08j58i0

RnJvbTogQW1qYWQgU2hhaHphZCA8YW1qYWRzaGFoemFkMjAwMEBnbWFpbC5jb20+CkRhdGU6IEZy
aSwgMDUgSnVuIDIwMjYgMDA6MDA6MDAgKzA1MDAKU3ViamVjdDogW1BBVENIIHYxXSBkYmxpbms6
IEZpeCBOVUxMIGRlcmVmZXJlbmNlIGNyYXNoIGluIGRibGlua19nZXRfbm90aWZ5KCkKCmRibGlu
a19nZXRfbm90aWZ5KCkgcmV0cmlldmVzIGFzeW5jIG5vdGlmaWNhdGlvbnMgZnJvbSBhIHJlbW90
ZQpjb25uZWN0aW9uLiBXaGVuIGNhbGxlZCB3aXRoIG5vIGFyZ3VtZW50cyBpdCB1c2VzIHRoZSBk
ZWZhdWx0Cih1bm5hbWVkKSBjb25uZWN0aW9uLiBJZiBubyBkZWZhdWx0IGNvbm5lY3Rpb24gaGFz
IGJlZW4gZXN0YWJsaXNoZWQsCnBjb25uLT5jb25uIGlzIE5VTEwuIFRoZSBjb2RlIGFzc2lnbmVk
IHRoaXMgTlVMTCB0byBjb25uIGFuZCB0aGVuCnBhc3NlZCBpdCBkaXJlY3RseSB0byBQUWNvbnN1
bWVJbnB1dCgpIGFuZCBQUW5vdGlmaWVzKCkgd2l0aG91dCBhbnkKY2hlY2s6CgogICAgZWxzZQog
ICAgICAgIGNvbm4gPSBwY29ubi0+Y29ubjsgICAvKiBOVUxMIGlmIG5vIGNvbm5lY3Rpb24gZXN0
YWJsaXNoZWQgKi8KCiAgICBJbml0TWF0ZXJpYWxpemVkU1JGKGZjaW5mbywgMCk7CgogICAgUFFj
b25zdW1lSW5wdXQoY29ubik7ICAgICAvKiBwYXNzZXMgTlVMTCB0byBsaWJwcSAqLwogICAgd2hp
bGUgKChub3RpZnkgPSBQUW5vdGlmaWVzKGNvbm4pKSAhPSBOVUxMKSAgLyogTlVMTCBkZXJlZmVy
ZW5jZSAqLwoKUFFub3RpZmllcyhOVUxMKSBkZXJlZmVyZW5jZXMgYSBudWxsIHBvaW50ZXIgaW50
ZXJuYWxseSwgY2F1c2luZyBhCmJhY2tlbmQgU0lHU0VHVi4gQW55IHVzZXIgd2l0aCBFWEVDVVRF
IG9uIHRoZSBmdW5jdGlvbiAoZ3JhbnRlZCB0bwpQVUJMSUMgYnkgZGVmYXVsdCkgY2FuIHRyaWdn
ZXIgdGhpcyB3aXRoIGEgc2luZ2xlIGNhbGw6CgogICAgU0VMRUNUICogRlJPTSBkYmxpbmtfZ2V0
X25vdGlmeSgpOwoKRXZlcnkgb3RoZXIgZnVuY3Rpb24gaW4gZGJsaW5rLmMgdGhhdCB1c2VzIHRo
ZSBkZWZhdWx0IGNvbm5lY3Rpb24KYWxyZWFkeSBoYXMgYW4gZXhwbGljaXQgTlVMTCBndWFyZCB2
aWEgZGJsaW5rX2Nvbm5fbm90X2F2YWlsKCkuCmRibGlua19nZXRfbm90aWZ5KCkgd2FzIHRoZSBv
bmx5IGV4Y2VwdGlvbi4KCkZpeCBieSBhZGRpbmcgdGhlIHNhbWUgTlVMTCBjaGVjayB1c2VkIGV2
ZXJ5d2hlcmUgZWxzZSBpbiB0aGUgZmlsZS4KClJlZ3Jlc3Npb24gdGVzdHM6IGFsbCAyLzIgZGJs
aW5rIHRlc3RzIHBhc3Mgd2l0aCB0aGlzIHBhdGNoIGFwcGxpZWQKKG1lc29uIHRlc3QgLS1zdWl0
ZSBkYmxpbmsgb24gbWFzdGVyIDAzOTJmYjkwMGViKS4KClJlcG9ydGVkLWJ5OiBBbWphZCBTaGFo
emFkIDxhbWphZHNoYWh6YWQyMDAwQGdtYWlsLmNvbT4KLS0tCiBjb250cmliL2RibGluay9kYmxp
bmsuYyB8IDUgKysrKy0KIDEgZmlsZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKyksIDEgZGVsZXRp
b24oLSkKCmRpZmYgLS1naXQgYS9jb250cmliL2RibGluay9kYmxpbmsuYyBiL2NvbnRyaWIvZGJs
aW5rL2RibGluay5jCmluZGV4IGQ4NDNlZWU3ZTk3Li42ZTE3Zjg2MTEzZCAxMDA2NDQKLS0tIGEv
Y29udHJpYi9kYmxpbmsvZGJsaW5rLmMKKysrIGIvY29udHJpYi9kYmxpbmsvZGJsaW5rLmMKQEAg
LTE4OTAsNyArMTg5MCwxMSBAQCBkYmxpbmtfZ2V0X25vdGlmeShQR19GVU5DVElPTl9BUkdTKQog
CWlmIChQR19OQVJHUygpID09IDEpCiAJCWNvbm4gPSBkYmxpbmtfZ2V0X25hbWVkX2Nvbm4odGV4
dF90b19jc3RyaW5nKFBHX0dFVEFSR19URVhUX1BQKDApKSk7CiAJZWxzZQorCXsKIAkJY29ubiA9
IHBjb25uLT5jb25uOworCQlpZiAoIWNvbm4pCisJCQlkYmxpbmtfY29ubl9ub3RfYXZhaWwoTlVM
TCk7CisJfQoKIAlJbml0TWF0ZXJpYWxpemVkU1JGKGZjaW5mbywgMCk7Ci0tClBvc3RncmVTUUwg
bWFzdGVyLTAzOTJmYjkwMGViCg==
--00000000000003840c06537776e3--