[PATCH] xml2: don't crash on namespace nodes in xpath

public inbox for [email protected]  
help / color / mirror / Atom feed

[PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
351+ messages / 1 participants
[nested] [flat]

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

* [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
@ 2026-06-10 23:24  Andrey Chernyy <[email protected]>
  0 siblings, 0 replies; 351+ messages in thread

From: Andrey Chernyy @ 2026-06-10 23:24 UTC (permalink / raw)

pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type.  Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend.  Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
 contrib/xml2/xpath.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				}
 				else
 				{
+					xmlNodePtr	node = nodeset->nodeTab[i];
+
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
 						xmlBufferWriteChar(buf, "<");
 						xmlBufferWriteCHAR(buf, septagname);
 						xmlBufferWriteChar(buf, ">");
 					}
-					xmlNodeDump(buf,
-								nodeset->nodeTab[i]->doc,
-								nodeset->nodeTab[i],
-								1, 0);
+
+					if (node->type == XML_NAMESPACE_DECL)
+					{
+						str = xmlXPathCastNodeToString(node);
+						if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate node text");
+						xmlBufferWriteCHAR(buf, str);
+						xmlFree(str);
+						str = NULL;
+					}
+					else
+						xmlNodeDump(buf, node->doc, node, 1, 0);
 
 					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
 					{
-- 
2.54.0


--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql

Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=

--MP_/QSClNE9NwyljXO+PMF4CHMj--





^ permalink  raw  reply  [nested|flat] 351+ messages in thread

end of thread, other threads:[~2026-06-10 23:24 UTC | newest]

Thread overview: 351+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>
2026-06-10 23:24 [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset() Andrey Chernyy <[email protected]>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox