public inbox for [email protected]  

help / color / mirror / Atom feed

From: Michael Paquier <[email protected]>
To: [email protected]
Subject: pgsql: hstore: Fix NULL pointer dereference with receive function
Date: Mon, 16 Feb 2026 23:42:01 +0000
Message-ID: <[email protected]> (raw)

hstore: Fix NULL pointer dereference with receive function

The receive function of hstore was not able to handle correctly
duplicate key values when a new duplicate links to a NULL value, where a
pfree() could be attempted on a NULL pointer, crashing due to a pointer
dereference.

This problem would happen for a COPY BINARY, when stacking values like
that:
aa => 5
aa => null

The second key/value pair is discarded and pfree() calls are attempted
on its key and its value, leading to a pointer dereference for the value
part as the value is NULL.  The first key/value pair takes priority when
a duplicate is found.

Per offline report.

Reported-by: "Anemone" <[email protected]>
Reported-by: "A1ex" <[email protected]>
Backpatch-through: 14

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/31d0b917d162b4d5401e1f0ebd27f987d44cbabf

Modified Files
--------------
contrib/hstore/hstore_io.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

view thread (6+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: pgsql: hstore: Fix NULL pointer dereference with receive function
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox