From: Euler Taveira <euler@eulerto.com>
To: Даниил Элишаков <dan-eli@mail.ru>
To: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18888: /src/interfaces/ecpg/preproc/descriptor.c possible NULL dereference
Date: Thu, 10 Apr 2025 15:17:17 -0300
Message-ID: <bfdf6ae4-7d27-4a1c-99b3-b6307637f106@app.fastmail.com> (raw)
In-Reply-To: <18888-31bcf4436ea6a20d@postgresql.org>
References: <18888-31bcf4436ea6a20d@postgresql.org>
On Thu, Apr 10, 2025, at 1:39 PM, PG Bug reporting form wrote:
> On 203 and 313 lines It seems that a struct data type should not be used in
> 'EXEC SQL SET DESCRIPTOR' command, so the code in question should never be
> executed and it is not a problem. However there are no actual checks for
> corrrectess of the provided data type. It is required to add a check against
> wrong data types supplied by the user.
Which struct data type? struct variable?
Did you read find_variable()? At the end, it has
if (p == NULL)
mmfatal(PARSE_ERROR, "variable \"%s\" is not declared", name);
return p;
mmfatal() is marked as noreturn so it is not possible that find_variable()
returns NULL. Hence, struct variable *v is always a valid pointer.
If you're directly opening bug reports based on a static analyzer output
without a previous analysis, don't do that. These SATs generally report lots of
false positives. Instead, investigate each report and (if possible) create a
reproducible test case demonstrating that it is a real issue.
--
Euler Taveira
EDB https://www.enterprisedb.com/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: euler@eulerto.com, dan-eli@mail.ru, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18888: /src/interfaces/ecpg/preproc/descriptor.c possible NULL dereference
In-Reply-To: <bfdf6ae4-7d27-4a1c-99b3-b6307637f106@app.fastmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox