pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: psql: Avoid returning oom_buffer from psql slash option scanner 14+ messages / 1 participants [nested] [flat]
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:39 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:39 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/1bb858c83103025742b7d2ca4d6f926564ba60e6 Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:39 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:39 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/8114617f783b93b09e24e829567366779b3e93d9 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e793e51abab3987dd55d4598316e60966c9e159e Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/9d4505b7f826b649501253c094aea5c28a66f266 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/789ae09a5f21487083c379727e434b7ba88fab6b Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3f01b0c4a826382837abc741020586e12777ad97 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d2e19268dc9f2fc9a28eeb8052b96d5f3f417f00 Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/ab001a3a6925e882d2585903a7448a250ec7b428 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3d41f014f1a09d800b40f3da169de8b77c6bc577 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/1c62efd14214ec666ea26e3bd94e33f16f00edf7 Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b57f962201b248c65d6034176871b28bc04072dc Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:40 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:40 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b2e391aea58834b36722a60351900f5f7617f9fc Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash option scanner @ 2026-08-19 03:41 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior. Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/de38e72a199117ef69d7653f91f849626b4dcf3b Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: psql: Avoid returning oom_buffer from psql slash command scanner @ 2026-08-19 03:41 Fujii Masao <fujii@postgresql.org> 0 siblings, 0 replies; 14+ messages in thread From: Fujii Masao @ 2026-08-19 03:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior. Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <zhjwpku@gmail.com> Author: Fujii Masao <masao.fujii@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Junwang Zhao <zhjwpku@gmail.com> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=fTDJ+ycuwxWMEn6bG_Yt4B5P+hE7AVw@mail.gmail.com Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e6c200f9a39a75da1bb829e87e99133ea5fea237 Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 14+ messages in thread
end of thread, other threads:[~2026-08-19 03:41 UTC | newest] Thread overview: 14+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-19 03:39 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:39 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:40 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:41 pgsql: psql: Avoid returning oom_buffer from psql slash command scanner Fujii Masao <fujii@postgresql.org> 2026-08-19 03:41 pgsql: psql: Avoid returning oom_buffer from psql slash option scanner Fujii Masao <fujii@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox