From: Grigorev Jurij <ju.grigorev@ftdata.ru>
To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Cc: jacob.champion@enterprisedb.com <jacob.champion@enterprisedb.com>
Cc: daniel@yesql.se <daniel@yesql.se>
Subject: Postmaster crashes on SIGHUP when oauth_validator_libraries holds only whitespace
Date: Mon, 14 Sep 2026 11:22:42 +0000
Message-ID: <04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain> (raw)
Hi,
I ran into a postmaster crash while investigating a static analyzer
report against 18.6. I reproduced it on master (92aaf50e230,
--enable-cassert, Debian 13/aarch64).
To reproduce, set the following in postgresql.conf:
oauth_validator_libraries = ' '
and add an OAuth line without validator= to pg_hba.conf:
host all all 127.0.0.1/32 oauth issuer="https://example.com"; scope="openid"
On reload the server log ends here:
LOG: received SIGHUP, reloading configuration files
LOG: parameter "oauth_validator_libraries" changed to " "
gdb then reports SIGSEGV in check_oauth_validator(), via load_hba().
The running instance goes down with every session on it. The same
configuration also prevents startup. pg_hba_file_rules() parses the
file from a regular backend, so the same NULL dereference there kills
the backend and the postmaster restarts the cluster.
check_oauth_validator() treats an unset list as an error by looking at
the raw GUC string, but SplitDirectoriesString() accepts a string of
spaces and returns NIL. The subsequent elemlist->length dereferences
that. This is a misconfiguration rather than a security issue -- the
GUC has PGC_SIGHUP context and is marked GUC_SUPERUSER_ONLY.
I've attached a patch against master that checks the parsed list
instead. It also adds a TAP test for reload. The patched master built
without warnings, and "make check" in src/test/modules/oauth_validator
passed with PG_TEST_EXTRA=oauth.
This appears to affect v18 onward, where OAuth support was added, so it
may need back-patching. The v18 error message has different wording
and would need a small adjustment.
Could someone take a look at the attached patch and let me know
if this is the right fix?
Thanks,
Yuriy=
Attachments:v1-0001-Fix-postmaster-crash-on-whitespace-only-oauth_valida.patch (application/octet-stream, 4.1K) download
From cf766ea59614e3c72a698e4f6dc4cd919da1b0d5 Mon Sep 17 00:00:00 2001
From: Yuriy Grigoryev <ju.grigorev@ftdata.ru>
Date: Mon, 14 Sep 2026 15:31:22 +0700
Subject: [PATCH] Fix postmaster crash on whitespace-only
oauth_validator_libraries
check_oauth_validator() rejects an unset validator list by looking at the
raw GUC string, which does not cover a value made up of whitespace only.
SplitDirectoriesString() accepts such a value and hands back an empty
list, so when the HBA line carries no validator= option the code went on
to read elemlist->length and dereferenced NIL.
Every entry point into HBA parsing is affected. load_hba() runs in the
postmaster at startup and again on SIGHUP, so reloading a running server
brings the whole instance down along with every session on it, and
pg_hba_file_rules() parses the file from a regular backend, where the
same crash forces a cluster-wide restart.
Check the parse result instead of the raw string, keeping the message the
empty setting already produced. Add a test that reloads a whitespace-only
setting and verifies that the server reports the error and stays up.
---
src/backend/libpq/auth-oauth.c | 31 +++++++++++--------
.../modules/oauth_validator/t/001_server.pl | 16 ++++++++++
2 files changed, 34 insertions(+), 13 deletions(-)
diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.cindex b769931..8dfe5f9 100644--- a/src/backend/libpq/auth-oauth.c+++ b/src/backend/libpq/auth-oauth.c@@ -863,19 +863,6 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
*err_msg = NULL;
- if (oauth_validator_libraries_string[0] == '\0')- {- ereport(elevel,- errcode(ERRCODE_CONFIG_FILE_ERROR),- errmsg("parameter \"%s\" must be set for authentication method \"%s\"",- "oauth_validator_libraries", "oauth"),- errcontext("line %d of configuration file \"%s\"",- line_num, file_name));- *err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",- "oauth_validator_libraries", "oauth");- return false;- }-
/* SplitDirectoriesString needs a modifiable copy */
rawstring = pstrdup(oauth_validator_libraries_string);
@@ -891,6 +878,24 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
goto done;
}
+ /*+ * An empty or all-whitespace setting is accepted by+ * SplitDirectoriesString(), which returns an empty list for it, so the+ * parse result has to be checked rather than the raw string.+ */+ if (elemlist == NIL)+ {+ ereport(elevel,+ errcode(ERRCODE_CONFIG_FILE_ERROR),+ errmsg("parameter \"%s\" must be set for authentication method \"%s\"",+ "oauth_validator_libraries", "oauth"),+ errcontext("line %d of configuration file \"%s\"",+ line_num, file_name));+ *err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",+ "oauth_validator_libraries", "oauth");+ goto done;+ }+
if (!hbaline->oauth_validator)
{
if (elemlist->length == 1)
diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.plindex 8941a35..86307be 100644--- a/src/test/modules/oauth_validator/t/001_server.pl+++ b/src/test/modules/oauth_validator/t/001_server.pl@@ -120,6 +120,22 @@ local all testparam oauth issuer="$issuer/param" scope="openid postgres"
});
$node->reload;
+$log_start =+ $node->wait_for_log(qr/reloading configuration files/, $log_start);++# An all-whitespace library list parses as an empty list. Reject it without+# crashing the postmaster during HBA reload.+$node->append_conf('postgresql.conf',+ "oauth_validator_libraries = ' '\n");+$node->reload;+$log_start = $node->wait_for_log(+ qr/parameter "oauth_validator_libraries" must be set/, $log_start);+is($bgconn->query_safe('SELECT 1'), '1',+ 'postmaster survives an empty OAuth validator list on reload');++$node->append_conf('postgresql.conf',+ "oauth_validator_libraries = 'validator'\n");+$node->reload;
$log_start =
$node->wait_for_log(qr/reloading configuration files/, $log_start);
--
2.39.5 (Apple Git-154)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: ju.grigorev@ftdata.ru, pgsql-bugs@lists.postgresql.org, jacob.champion@enterprisedb.com, daniel@yesql.se
Subject: Re: Postmaster crashes on SIGHUP when oauth_validator_libraries holds only whitespace
In-Reply-To: <04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox