agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Richard Guo <rguo@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: plperl: Fix NULL pointer dereference for forged array object
Date: Wed, 24 Jun 2026 00:18:36 +0000
Message-ID: <E1wcBK8-001bCd-0n@gemulon.postgresql.org> (raw)
plperl: Fix NULL pointer dereference for forged array object
In get_perl_array_ref(), for a PostgreSQL::InServer::ARRAY object, we
look up its "array" key with hv_fetch_string() and then inspect the
returned SV. However, hv_fetch_string() returns a NULL pointer when
the key is absent, and the code dereferenced that result without first
checking whether the pointer itself was NULL. As a result, a plperl
function returning a forged PostgreSQL::InServer::ARRAY object that
lacks the "array" key would crash the backend with a segmentation
fault.
Fix this by checking the pointer returned by hv_fetch_string() before
dereferencing it, matching how other callers in this file already
guard the result. With the check in place, such an object falls
through to the existing error report instead of crashing.
Author: Xing Guo <higuoxing@gmail.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/CACpMh+DYgcnqZwQLXXuxQcehJTd7T8UmKWSLsK4mFBEp9G2ajA@mail.gmail.com
Backpatch-through: 14
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/3854f4afca68c57df1289f0852a9e4481e153100
Modified Files
--------------
src/pl/plperl/expected/plperl_array.out | 7 +++++++
src/pl/plperl/plperl.c | 2 +-
src/pl/plperl/sql/plperl_array.sql | 7 +++++++
3 files changed, 15 insertions(+), 1 deletion(-)
view thread (6+ messages) latest in thread
Message-ID: <E1wcBK8-001bCd-0n@gemulon.postgresql.org>
Permalink: ../E1wcBK8-001bCd-0n@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wcBK8-001bCd-0n@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: rguo@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: plperl: Fix NULL pointer dereference for forged array object
In-Reply-To: <E1wcBK8-001bCd-0n@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox