MIME-Version: 1.0
References: <19511-f9f251767b658232@postgresql.org>
 <CADHzGZRAxFYoxMC+g6pEJ0FL0bfVhFi+y0jQ0cRNCC5hFjvJ3Q@mail.gmail.com>
In-Reply-To: 
 <CADHzGZRAxFYoxMC+g6pEJ0FL0bfVhFi+y0jQ0cRNCC5hFjvJ3Q@mail.gmail.com>
From: Fujii Masao <masao.fujii@gmail.com>
Date: Fri, 5 Jun 2026 13:45:06 +0900
Message-ID: 
 <CAHGQGwGt5qAAjgQONmC_sk=O9YtnXxPD12YOy_DODpixPXKU8A@mail.gmail.com>
Subject: Re: BUG #19511: contrib/dblink: NULL dereference in
 dblink_get_notify() when called without a prior connection
To: Amjad Shahzad <amjadshahzad2000@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAHGQGwGt5qAAjgQONmC_sk%3DO9YtnXxPD12YOy_DODpixPXKU8A%40mail.gmail.com>
Precedence: bulk

On Fri, Jun 5, 2026 at 10:20=E2=80=AFAM Amjad Shahzad
<amjadshahzad2000@gmail.com> wrote:
>> I found a NULL pointer dereference in contrib/dblink/dblink.c in the
>> dblink_get_notify() function. Any user with EXECUTE on the function
>> can crash their backend process with a single call. Confirmed against ma=
ster
>> commit 0392fb900eb.
>>
>> WHAT IS THE ISSUE
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> dblink_get_notify() retrieves async notifications from a remote connecti=
on.
>> When called with no arguments it uses the default
>> (unnamed) connection. If no default connection has been established firs=
t,
>> pconn->conn is NULL. The code assigns this NULL to conn and
>> then passes it directly to PQconsumeInput() and PQnotifies():
>>
>>     /* line 1893 (master) */
>>     else
>>         conn =3D pconn->conn;      /* NULL =E2=80=94 no connection estab=
lished */
>>
>>     InitMaterializedSRF(fcinfo, 0);
>>
>>     PQconsumeInput(conn);        /* passes NULL to libpq */
>>     while ((notify =3D PQnotifies(conn)) !=3D NULL)  /* NULL dereference=
 */
>>
>> PQnotifies(NULL) dereferences a null pointer internally, causing a backe=
nd
>> SIGSEGV.

Can this segmentation fault actually happen?

PQconsumeInput() and PQnotifies() both simply return immediately when
conn =3D=3D NULL. So even if dblink_get_notify() calls them with a NULL con=
n,
it doesn't seem like that would lead to a segmentation fault.
Am I missing something?

Regards,

--=20
Fujii Masao