From: Grigorev Jurij <ju.grigorev@ftdata.ru>
To: Daniel Gustafsson <daniel@yesql.se>, Jacob Champion
	<jacob.champion@enterprisedb.com>
CC: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: Postmaster crashes on SIGHUP when oauth_validator_libraries holds
 only whitespace
Thread-Topic: Postmaster crashes on SIGHUP when oauth_validator_libraries
 holds only whitespace
Thread-Index: AQHdRDwfKXFGhwTBsEutXNp1kv9EqbbOIigAgAABkwCAAMnujw==
Date: Tue, 15 Sep 2026 02:55:55 +0000
Message-ID: <c7e77341b94e406bb77e8cd3367cae59@localhost.localdomain>
References: <04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain>
 <19B73F3F-8FAE-43B6-8746-21FE466026B8@yesql.se>
 <CAOYmi+=JYJaAuPAcHYNptOQJaLHM5i6ex_wH0aS4QP9ngukX2A@mail.gmail.com>,<A1C4C529-9ACC-46AF-8AA8-AD7670FE277B@yesql.se>
In-Reply-To: <A1C4C529-9ACC-46AF-8AA8-AD7670FE277B@yesql.se>
Accept-Language: ru-RU, en-US
Content-Language: ru-RU
Content-Type: multipart/mixed;
	boundary="_002_c7e77341b94e406bb77e8cd3367cae59ftdataru_"
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/c7e77341b94e406bb77e8cd3367cae59%40localhost.localdomain>
Precedence: bulk

--_002_c7e77341b94e406bb77e8cd3367cae59ftdataru_
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

Hi Jacob, Daniel,

Thanks for the review!  In the attached v2 I removed the explanatory
comment and call query_safe() directly.  The functional change and the
reload test are otherwise unchanged.

Also left the validator-name canonicalization issue out of this patch.

Checked, the patch builds cleanly against master with --enable-cassert,
and PG_TEST_EXTRA=3Doauth make check in src/test/modules/oauth_validator
passes all 190 tests.

Regards,
  Yuriy
________________________________________
=EF=D4: Daniel Gustafsson <daniel@yesql.se>
=EF=D4=D0=D2=C1=D7=CC=C5=CE=CF: 15 =D3=C5=CE=D4=D1=C2=D2=D1 2026 =C7. 4:34:=
08
=EB=CF=CD=D5: Jacob Champion
=EB=CF=D0=C9=D1: =E7=D2=C9=C7=CF=D2=D8=C5=D7 =E0=D2=C9=CA; pgsql-bugs@lists=
.postgresql.org
=F4=C5=CD=C1: Re: Postmaster crashes on SIGHUP when oauth_validator_librari=
es holds only whitespace

> On 14 Sep 2026, at 23:28, Jacob Champion <jacob.champion@enterprisedb.com=
> wrote:

>> + /*
>> + * An empty or all-whitespace setting is accepted by
>> + * SplitDirectoriesString(), which returns an empty list for it, so the
>> + * parse result has to be checked rather than the raw string.
>> + */
>
> Sometimes recording a historical bug in the comments can help prevent
> future mistakes... but I don't think this is one of those cases,
> especially since the new test prevents accidental regression.

+1

> This seems like a good time to mention that I have a checklist item to
> fix the following (shouldn't block this patch):
>
>> if (!SplitDirectoriesString(rawstring, ',', &elemlist))
>> ...
>> if (strcmp(allowed, hbaline->oauth_validator) =3D=3D 0)
>
> SplitDirectoriesString() canonicalizes its outputs, which we then
> compare against the uncanonicalized hbaline->oauth_validator. That
> could lead to annoying false negatives in more complicated setups.

Right, this patch wont move the needle in the wrong direction for future fi=
xes
AFAICT.

--
Daniel Gustafsson


--_002_c7e77341b94e406bb77e8cd3367cae59ftdataru_
Content-Type: application/octet-stream;
	name="v2-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch"
Content-Description: 
 v2-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch
Content-Disposition: attachment;
	filename="v2-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch";
	size=3675; creation-date="Tue, 15 Sep 2026 02:54:46 GMT";
	modification-date="Tue, 15 Sep 2026 02:54:46 GMT"
Content-Transfer-Encoding: base64

RnJvbSBjNDE0NGRjMWEzN2VhOTMzYTI5ODViOTM0MGI3OWI5MjMyMTIyZDhhIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBZdXJpeSBHcmlnb3J5ZXYgPGp1LmdyaWdvcmV2QGZ0ZGF0YS5y
dT4KRGF0ZTogVHVlLCAxNSBTZXAgMjAyNiAwOTozNDozNiArMDcwMApTdWJqZWN0OiBbUEFUQ0gg
djJdIEZpeCBwb3N0bWFzdGVyIGNyYXNoIG9uIHdoaXRlc3BhY2Utb25seQogb2F1dGhfdmFsaWRh
dG9yX2xpYnJhcmllcwoKY2hlY2tfb2F1dGhfdmFsaWRhdG9yKCkgY2hlY2tzIHRoZSByYXcgR1VD
IHN0cmluZyBmb3IgYW4gZW1wdHkgdmFsaWRhdG9yCmxpc3QuICBUaGF0IGRvZXMgbm90IGNvdmVy
IGEgdmFsdWUgY29udGFpbmluZyBvbmx5IHdoaXRlc3BhY2UuClNwbGl0RGlyZWN0b3JpZXNTdHJp
bmcoKSBhY2NlcHRzIHN1Y2ggaW5wdXQgYW5kIHJldHVybnMgYW4gZW1wdHkgbGlzdCwgc28KdGhl
IGNvZGUgZGVyZWZlcmVuY2VzIE5JTCB3aGVuIGFuIE9BdXRoIEhCQSBsaW5lIGhhcyBubyB2YWxp
ZGF0b3Igb3B0aW9uLgpUaGlzIGNhbiBjcmFzaCB0aGUgcG9zdG1hc3RlciB3aGlsZSBwcm9jZXNz
aW5nIFNJR0hVUC4KCkNoZWNrIHRoZSBwYXJzZWQgbGlzdCBpbnN0ZWFkIGFuZCBhZGQgYSBUQVAg
dGVzdCB0aGF0IHJlbG9hZHMgYW4gaW52YWxpZAp3aGl0ZXNwYWNlLW9ubHkgc2V0dGluZyBhbmQg
dmVyaWZpZXMgdGhhdCB0aGUgc2VydmVyIHJlbWFpbnMgYXZhaWxhYmxlLgotLS0KIHNyYy9iYWNr
ZW5kL2xpYnBxL2F1dGgtb2F1dGguYyAgICAgICAgICAgICAgICB8IDI4ICsrKysrKysrKy0tLS0t
LS0tLS0KIC4uLi9tb2R1bGVzL29hdXRoX3ZhbGlkYXRvci90LzAwMV9zZXJ2ZXIucGwgICB8IDE2
ICsrKysrKysrKysrCiAyIGZpbGVzIGNoYW5nZWQsIDMwIGluc2VydGlvbnMoKyksIDE0IGRlbGV0
aW9ucygtKQoKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYyBiL3Ny
Yy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYwppbmRleCBiNzY5OTMxY2E0Zi4uOTBkMjIzZWVk
MDAgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL2xpYnBxL2F1dGgtb2F1dGguYworKysgYi9zcmMv
YmFja2VuZC9saWJwcS9hdXRoLW9hdXRoLmMKQEAgLTg2MywxOSArODYzLDYgQEAgY2hlY2tfb2F1
dGhfdmFsaWRhdG9yKEhiYUxpbmUgKmhiYWxpbmUsIGludCBlbGV2ZWwsIGNoYXIgKiplcnJfbXNn
KQogCiAJKmVycl9tc2cgPSBOVUxMOwogCi0JaWYgKG9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXNf
c3RyaW5nWzBdID09ICdcMCcpCi0JewotCQllcmVwb3J0KGVsZXZlbCwKLQkJCQllcnJjb2RlKEVS
UkNPREVfQ09ORklHX0ZJTEVfRVJST1IpLAotCQkJCWVycm1zZygicGFyYW1ldGVyIFwiJXNcIiBt
dXN0IGJlIHNldCBmb3IgYXV0aGVudGljYXRpb24gbWV0aG9kIFwiJXNcIiIsCi0JCQkJCSAgICJv
YXV0aF92YWxpZGF0b3JfbGlicmFyaWVzIiwgIm9hdXRoIiksCi0JCQkJZXJyY29udGV4dCgibGlu
ZSAlZCBvZiBjb25maWd1cmF0aW9uIGZpbGUgXCIlc1wiIiwKLQkJCQkJCSAgIGxpbmVfbnVtLCBm
aWxlX25hbWUpKTsKLQkJKmVycl9tc2cgPSBwc3ByaW50ZigicGFyYW1ldGVyIFwiJXNcIiBtdXN0
IGJlIHNldCBmb3IgYXV0aGVudGljYXRpb24gbWV0aG9kIFwiJXNcIiIsCi0JCQkJCQkJIm9hdXRo
X3ZhbGlkYXRvcl9saWJyYXJpZXMiLCAib2F1dGgiKTsKLQkJcmV0dXJuIGZhbHNlOwotCX0KLQog
CS8qIFNwbGl0RGlyZWN0b3JpZXNTdHJpbmcgbmVlZHMgYSBtb2RpZmlhYmxlIGNvcHkgKi8KIAly
YXdzdHJpbmcgPSBwc3RyZHVwKG9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXNfc3RyaW5nKTsKIApA
QCAtODkxLDkgKzg3OCwyMiBAQCBjaGVja19vYXV0aF92YWxpZGF0b3IoSGJhTGluZSAqaGJhbGlu
ZSwgaW50IGVsZXZlbCwgY2hhciAqKmVycl9tc2cpCiAJCWdvdG8gZG9uZTsKIAl9CiAKKwlpZiAo
ZWxlbWxpc3QgPT0gTklMKQorCXsKKwkJZXJlcG9ydChlbGV2ZWwsCisJCQkJZXJyY29kZShFUlJD
T0RFX0NPTkZJR19GSUxFX0VSUk9SKSwKKwkJCQllcnJtc2coInBhcmFtZXRlciBcIiVzXCIgbXVz
dCBiZSBzZXQgZm9yIGF1dGhlbnRpY2F0aW9uIG1ldGhvZCBcIiVzXCIiLAorCQkJCQkgICAib2F1
dGhfdmFsaWRhdG9yX2xpYnJhcmllcyIsICJvYXV0aCIpLAorCQkJCWVycmNvbnRleHQoImxpbmUg
JWQgb2YgY29uZmlndXJhdGlvbiBmaWxlIFwiJXNcIiIsCisJCQkJCQkgICBsaW5lX251bSwgZmls
ZV9uYW1lKSk7CisJCSplcnJfbXNnID0gcHNwcmludGYoInBhcmFtZXRlciBcIiVzXCIgbXVzdCBi
ZSBzZXQgZm9yIGF1dGhlbnRpY2F0aW9uIG1ldGhvZCBcIiVzXCIiLAorCQkJCQkJCSJvYXV0aF92
YWxpZGF0b3JfbGlicmFyaWVzIiwgIm9hdXRoIik7CisJCWdvdG8gZG9uZTsKKwl9CisKIAlpZiAo
IWhiYWxpbmUtPm9hdXRoX3ZhbGlkYXRvcikKIAl7Ci0JCWlmIChlbGVtbGlzdC0+bGVuZ3RoID09
IDEpCisJCWlmIChsaXN0X2xlbmd0aChlbGVtbGlzdCkgPT0gMSkKIAkJewogCQkJaGJhbGluZS0+
b2F1dGhfdmFsaWRhdG9yID0gcHN0cmR1cChsaW5pdGlhbChlbGVtbGlzdCkpOwogCQkJZ290byBk
b25lOwpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvbW9kdWxlcy9vYXV0aF92YWxpZGF0b3IvdC8wMDFf
c2VydmVyLnBsIGIvc3JjL3Rlc3QvbW9kdWxlcy9vYXV0aF92YWxpZGF0b3IvdC8wMDFfc2VydmVy
LnBsCmluZGV4IDg5NDFhMzU1NDIzLi42NWY3M2NiZGJiMiAxMDA2NDQKLS0tIGEvc3JjL3Rlc3Qv
bW9kdWxlcy9vYXV0aF92YWxpZGF0b3IvdC8wMDFfc2VydmVyLnBsCisrKyBiL3NyYy90ZXN0L21v
ZHVsZXMvb2F1dGhfdmFsaWRhdG9yL3QvMDAxX3NlcnZlci5wbApAQCAtMTIzLDYgKzEyMywyMiBA
QCAkbm9kZS0+cmVsb2FkOwogJGxvZ19zdGFydCA9CiAgICRub2RlLT53YWl0X2Zvcl9sb2cocXIv
cmVsb2FkaW5nIGNvbmZpZ3VyYXRpb24gZmlsZXMvLCAkbG9nX3N0YXJ0KTsKIAorIyBBbiBhbGwt
d2hpdGVzcGFjZSBsaWJyYXJ5IGxpc3QgcGFyc2VzIGFzIGFuIGVtcHR5IGxpc3QuICBSZWplY3Qg
aXQgd2l0aG91dAorIyBjcmFzaGluZyB0aGUgcG9zdG1hc3RlciBkdXJpbmcgSEJBIHJlbG9hZC4K
KyRub2RlLT5hcHBlbmRfY29uZigncG9zdGdyZXNxbC5jb25mJywKKwkib2F1dGhfdmFsaWRhdG9y
X2xpYnJhcmllcyA9ICcgICAnXG4iKTsKKyRub2RlLT5yZWxvYWQ7CiskbG9nX3N0YXJ0ID0gJG5v
ZGUtPndhaXRfZm9yX2xvZygKKwlxci9wYXJhbWV0ZXIgIm9hdXRoX3ZhbGlkYXRvcl9saWJyYXJp
ZXMiIG11c3QgYmUgc2V0IGZvciBhdXRoZW50aWNhdGlvbi8sCisJJGxvZ19zdGFydCk7CiskYmdj
b25uLT5xdWVyeV9zYWZlKCdTRUxFQ1QgMScpOworCiskbm9kZS0+YXBwZW5kX2NvbmYoJ3Bvc3Rn
cmVzcWwuY29uZicsCisJIm9hdXRoX3ZhbGlkYXRvcl9saWJyYXJpZXMgPSAndmFsaWRhdG9yJ1xu
Iik7Ciskbm9kZS0+cmVsb2FkOworJGxvZ19zdGFydCA9ICRub2RlLT53YWl0X2Zvcl9sb2cocXIv
cmVsb2FkaW5nIGNvbmZpZ3VyYXRpb24gZmlsZXMvLAorCSRsb2dfc3RhcnQpOworCiAjIENoZWNr
IHBnX2hiYV9maWxlX3J1bGVzKCkgc3VwcG9ydC4KIG15ICRjb250ZW50cyA9ICRiZ2Nvbm4tPnF1
ZXJ5X3NhZmUoCiAJcXEoU0VMRUNUIHJ1bGVfbnVtYmVyLCBhdXRoX21ldGhvZCwgb3B0aW9ucwot
LSAKMi4zOS41IChBcHBsZSBHaXQtMTU0KQoK

--_002_c7e77341b94e406bb77e8cd3367cae59ftdataru_--