public inbox for [email protected]
help / color / mirror / Atom feedFrom: Andrey Chernyy <[email protected]>
Subject: [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
Date: Thu, 11 Jun 2026 02:24:40 +0300
pgxmlNodeSetToText() passed nodeTab[i]->doc to xmlNodeDump() without checking
the node type. Namespace-axis results are XML_NAMESPACE_DECL nodes (xmlNs
structs cast to xmlNodePtr) whose ->doc field is out of bounds, so xmlNodeDump()
dereferenced a bogus pointer and crashed the backend. Render such nodes with
xmlXPathCastNodeToString() instead, as xpath_table() already does.
---
contrib/xml2/xpath.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 283bb51178d..25a1cc47577 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -188,16 +188,27 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
}
else
{
+ xmlNodePtr node = nodeset->nodeTab[i];
+
if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
{
xmlBufferWriteChar(buf, "<");
xmlBufferWriteCHAR(buf, septagname);
xmlBufferWriteChar(buf, ">");
}
- xmlNodeDump(buf,
- nodeset->nodeTab[i]->doc,
- nodeset->nodeTab[i],
- 1, 0);
+
+ if (node->type == XML_NAMESPACE_DECL)
+ {
+ str = xmlXPathCastNodeToString(node);
+ if (str == NULL || pg_xml_error_occurred(xmlerrcxt))
+ xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+ "could not allocate node text");
+ xmlBufferWriteCHAR(buf, str);
+ xmlFree(str);
+ str = NULL;
+ }
+ else
+ xmlNodeDump(buf, node->doc, node, 1, 0);
if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
{
--
2.54.0
--MP_/QSClNE9NwyljXO+PMF4CHMj
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-nsdump-crash-repro.sql
Q1JFQVRFIEVYVEVOU0lPTiBJRiBOT1QgRVhJU1RTIHhtbDI7CgpTRUxFQ1QgeHBhdGhfbm9kZXNl
dCgKICAgICAgICAgICAnPHJvb3QgeG1sbnM6Zm9vPSJodHRwOi8vZXhhbXBsZS5jb20vZm9vIj48
Y2hpbGQvPjwvcm9vdD4nLAogICAgICAgICAgICcvL25hbWVzcGFjZTo6KicpOwo=
--MP_/QSClNE9NwyljXO+PMF4CHMj--
view thread (351+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected]
Subject: Re: [PATCH] xml2: don't crash on namespace nodes in xpath_nodeset()
In-Reply-To: <no-message-id-24458@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox