Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Tue, 08 Jul 2025 09:49:20 +0000
Message-Id: <DB6KVQ60OJ8X.A8LWANY82NLG@b1-systems.de>
Cc: "Tom Lane" <tgl@sss.pgh.pa.us>, <pgsql-bugs@lists.postgresql.org>,
 <maralist86@mail.ru>
Subject: Re: BUG #18943: Return value of a function 'xmlBufferCreate' is
 dereferenced at xpath.c:177 without checking for NUL
From: "Robin Haberkorn" <haberkorn@b1-systems.de>
To: "Michael Paquier" <michael@paquier.xyz>, "Jim Jones"
 <jim.jones@uni-muenster.de>
References: <18943-2f2a04ab03904598@postgresql.org>
 <aD001M5BUG9GwF_Y@paquier.xyz> <aD53hVjiW-9C29VT@paquier.xyz>
 <861593.1748970933@sss.pgh.pa.us> <aEEingzOta_S_Nu7@paquier.xyz>
 <CAPLXN34Dr3Gbi+xJ6BgCeTyBJkMVe3cn7qxoADV72rC9ZHeBtQ@mail.gmail.com>
 <d2410ca0-c0dd-4f63-9e70-3d7a62a5d705@uni-muenster.de>
 <b35e2342-0f02-4365-94cf-55052ac9bda1@uni-muenster.de>
 <aEKCoNIfLxjyKY3r@paquier.xyz>
 <31f3480e-cd7d-4021-b392-87922572cc37@uni-muenster.de>
 <aETzMep2fGfB0AIp@paquier.xyz>
In-Reply-To: <aETzMep2fGfB0AIp@paquier.xyz>
Archived-At: <https://www.postgresql.org/message-id/DB6KVQ60OJ8X.A8LWANY82NLG%40b1-systems.de>
Precedence: bulk

Hello Michael!

On Sun Jun 8, 2025 at 05:19:29 GMT +03, Michael Paquier wrote:
> I have updated the patches with the attached, splitting the parts for
> contrib/xml2/ and the backend into two parts.  These touch error paths
> that are very unlikely going to be hit in practice, so let's do all
> that once v19 opens for business only on HEAD.

I know this has already been committed, but why are we still using
PG_XML_STRICTNESS_LEGACY in xpath.c? As we are always checking
pg_xml_error_occurred() this should no longer be necessary.

It's of course also still in xslt_proc.c, but I have submitted a
separate patch to the ongoing Commitfest, which will resolve that. [1]

Best regards,
Robin Haberkorn

[1] https://commitfest.postgresql.org/patch/5718/
btw. it's still looking for a rewiever.

--=20
Robin Haberkorn
Software Engineer

B1 Systems GmbH
Osterfeldstra=C3=9Fe 7 / 85088 Vohburg / https://www.b1-systems.de
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt, HRB 3537