Feedback-ID: i0fe9450f:Fastmail
Date: Thu, 11 Jun 2026 10:48:30 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Andrey Chernyy <andrey.cherny@tantorlabs.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: [PATCH] contrib/xml2: backend crash in xpath_nodeset() on the
 namespace axis
Message-ID: <aioT7ui_ZJ9RMlfM@paquier.xyz>
References: <20260611031436.5afde3cb@andrnote>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="6PfPrMsmHfVR1jJo"
Content-Disposition: inline
In-Reply-To: <20260611031436.5afde3cb@andrnote>
Archived-At: 
 <https://www.postgresql.org/message-id/aioT7ui_ZJ9RMlfM%40paquier.xyz>
Precedence: bulk


--6PfPrMsmHfVR1jJo
Content-Type: multipart/mixed; boundary="XH4i2kpv9mCEifpe"
Content-Disposition: inline


--XH4i2kpv9mCEifpe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jun 11, 2026 at 03:14:36AM +0300, Andrey Chernyy wrote:
> Reproduced on master; the same unguarded xmlNodeDump() call in
> pgxmlNodeSetToText() is present on every supported back-branch (REL_18
> through REL_14).
>=20
> Patch attached: render XML_NAMESPACE_DECL nodes with
> xmlXPathCastNodeToString() like xpath_table() does.  The repro then
> returns the namespace text, ordinary node-set output is unchanged, and
> the xml2 regression test passes.

Thanks for the report, that looks about right to fix the way you are
doing in xml2.  Some tests and we should be good.

Hmm.  We have a second caller of xmlNodeDump() in the core backend
code in adt/xml.c, leading to a confusing error if I try to use a
namespace:
=3D# select xpath('//namespace::*', '<root xmlns:foo=3D"http://example.com"=
/>'::xml);
ERROR:  53200: could not copy node
CONTEXT:  SQL function "xpath" statement 1
LOCATION:  xml_ereport, xml.c:2082

It looks to me that we should fallback to xmlXPathCastNodeToString()
when dealing with a NAMESPACE_DECL.  The attached patch leads me to
the following result, that looks much better:
=3D# select xpath('//namespace::*', '<root xmlns:foo=3D"http://example.com"=
/>'::xml);
                           xpath
-----------------------------------------------------------
 {http://www.w3.org/XML/1998/namespace,http://example.com}
(1 row)

What do you think?  That also deserves a backpatch to me, even if it
is less worse than the xml2 crash you have reported.

I have grouped this fix with your patch in the attached.  Both still
need some tests.  Each fix deserves its own commit, that's just a
quick FYI version.
--
Michael

--XH4i2kpv9mCEifpe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment;
	filename=v2-0001-xml2-don-t-crash-on-namespace-nodes-in-xpath_node.patch
Content-Transfer-Encoding: quoted-printable

=46rom 075d59e29cd4a1fd5595bb4fb2596f40e5a12569 Mon Sep 17 00:00:00 2001
=46rom: Michael Paquier <michael@paquier.xyz>
Date: Thu, 11 Jun 2026 10:45:10 +0900
Subject: [PATCH v2] xml2: don't crash on namespace nodes in xpath_nodeset()

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without
checking the node type.  Namespace-axis results are XML_NAMESPACE_DECL
nodes (xmlNs structs cast to xmlNodePtr) whose ->doc field is out of
bounds, so xmlNodeDump() dereferenced a bogus pointer and crashed the
backend.  Render such nodes with xmlXPathCastNodeToString() instead, as
xpath_table() already does.
---
 src/backend/utils/adt/xml.c |  3 ++-
 contrib/xml2/xpath.c        | 19 +++++++++++++++----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
index 2c7f778cfdb7..a50992876cd6 100644
--- a/src/backend/utils/adt/xml.c
+++ b/src/backend/utils/adt/xml.c
@@ -4199,7 +4199,8 @@ xml_xmlnodetoxmltype(xmlNodePtr cur, PgXmlErrorContex=
t *xmlerrcxt)
 {
 	xmltype    *result =3D NULL;
=20
-	if (cur->type !=3D XML_ATTRIBUTE_NODE && cur->type !=3D XML_TEXT_NODE)
+	if (cur->type !=3D XML_ATTRIBUTE_NODE && cur->type !=3D XML_TEXT_NODE &&
+		cur->type !=3D XML_NAMESPACE_DECL)
 	{
 		void		(*volatile nodefree) (xmlNodePtr) =3D NULL;
 		volatile xmlBufferPtr buf =3D NULL;
diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d1..25a1cc47577a 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node =3D nodeset->nodeTab[i];
+
 					if ((septagname !=3D NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type =3D=3D XML_NAMESPACE_DECL)
+					{
+						str =3D xmlXPathCastNodeToString(node);
+						if (str =3D=3D NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str =3D NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
=20
 					if ((septagname !=3D NULL) && (xmlStrlen(septagname) > 0))
 					{
--=20
2.54.0


--XH4i2kpv9mCEifpe--

--6PfPrMsmHfVR1jJo
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmoqE+4ACgkQnvQgOdby
QH1Nvw/9FPIlnnl4TGbZlECYo05Ix0u3uyuP0+xpWrhJbUPKdXQ/Q+HIauHt14d0
aITqzpycUIsFEfBuTXATPWSB3YNh9yy37/F6U07vhr91/OJMuEgfIvBy+pRoY8qD
dV2rtykAQiRbXbO6Pk3rb34yXBQ3oGMtLPsuXli0QcsOqVt63mzhKEhAEtyeKC7q
1tQ7TEpDaQ0bKqyqrMS4SMFKJZaInIL498uwWh3kHFTEkgI0CoEuNnDt5E61eA2J
+r2P0SCbmedyMHJjyhpNfrnWqTc49bk5aE2E8r4QYnNnJyEixrQH8AxbWeGRpcBi
XQfndDzMB/qCqq4/X21VzegoxUs6xnA3ezHEkBfAp8Tgsg7DzMsKlQ2ML7rFFVhb
Q7JaKmdyv4fKj+G+JFaFWQv7J5xQa3e8jM293MoNB5UisbLHynhbaUwXbQ5+RvNE
LL1QrasHzMIDdq1tglc3xxZA0ETk2PSh7G0Hxj8hGx1h3jot56aZqCcvOeq7+iUL
kiuLvYT99Se9ngIBGLimRovx95c6LITgNKkVy8GURutD9xtrULOTGzGKwzq+O1AB
n+ptiP7p8QR1IWINac/pRtC8CY3RCx1uTqvA6V+fNjHASXm2cFAV67Y8wCek3pVA
VsTVEbFd2oT1wv993In4/pMciK/RpRpCbf+JS0z3ut7Joswkr/g=
=cXZP
-----END PGP SIGNATURE-----

--6PfPrMsmHfVR1jJo--