Date: Fri, 5 Jun 2026 02:46:42 +0300
From: Andrey Chernyy <andrey.cherny@tantorlabs.com>
To: pgsql-hackers@lists.postgresql.org
Subject: [PATCH] xml2: Fix stylesheet document leak in xslt_process()
Message-ID: <20260605024642.5a1b6518@andrnote>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="MP_/JNWBJ4_fkREZAfM76xZSan6"
Archived-At: 
 <https://www.postgresql.org/message-id/20260605024642.5a1b6518%40andrnote>
Precedence: bulk

--MP_/JNWBJ4_fkREZAfM76xZSan6
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

While following up on the recent xml2 XPath leak fixes at
https://postgr.es/m/20260601010124.5edf9a20@andrnote, I noticed the same
class of libxml/libxslt ownership issue in xslt_process().

xslt_process() parses the stylesheet argument with xmlReadMemory(), then
passes the resulting xmlDoc to xsltParseStylesheetDoc().  On failure,
libxslt leaves that document owned by the caller, as can be seen from
its own xsltParseStylesheetFile() wrapper.  Postgres currently cannot
release it in the error cleanup path because ssdoc is scoped inside the
PG_TRY block.

The attached patch keeps ssdoc visible to the cleanup path, clears it
once ownership has been transferred to the stylesheet, and frees it in
PG_CATCH if parsing failed before that transfer completed.

I also attached a manual repro script.  It repeatedly calls
xslt_process() with a large XML document that is not a stylesheet,
catches the ERROR in one backend, and samples VmRSS via /proc.

On my machine, without the patch, the same backend kept growing after
each failed parse:

NOTICE:  xslt_process i=1, failures=1, total_kb=34668, diff_kb=12992
NOTICE:  xslt_process i=2, failures=1, total_kb=44428, diff_kb=9760
NOTICE:  xslt_process i=3, failures=1, total_kb=54120, diff_kb=9692
NOTICE:  xslt_process i=4, failures=1, total_kb=63808, diff_kb=9688
NOTICE:  xslt_process i=5, failures=1, total_kb=73496, diff_kb=9688
NOTICE:  xslt_process i=6, failures=1, total_kb=83188, diff_kb=9692
NOTICE:  xslt_process i=7, failures=1, total_kb=92876, diff_kb=9688
NOTICE:  xslt_process i=8, failures=1, total_kb=102564, diff_kb=9688
NOTICE:  xslt_process i=9, failures=1, total_kb=112256, diff_kb=9692
NOTICE:  xslt_process i=10, failures=1, total_kb=121944, diff_kb=9688

With the patch, it plateaued after the initial warmup:

NOTICE:  xslt_process i=1, failures=1, total_kb=23228, diff_kb=1596
NOTICE:  xslt_process i=2, failures=1, total_kb=23888, diff_kb=660
NOTICE:  xslt_process i=3, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=4, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=5, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=6, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=7, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=8, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=9, failures=1, total_kb=23888, diff_kb=0
NOTICE:  xslt_process i=10, failures=1, total_kb=23888, diff_kb=0

--
Andrey Chernyy

--MP_/JNWBJ4_fkREZAfM76xZSan6
Content-Type: application/sql
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=xml2-xslt-process-leak-repro.sql

XHNldCBPTl9FUlJPUl9TVE9QIG9uCgpDUkVBVEUgRVhURU5TSU9OIElGIE5PVCBFWElTVFMgeG1s
MjsKCkNSRUFURSBPUiBSRVBMQUNFIEZVTkNUSU9OIHBnX3RlbXAudm1yc3Nfa2IoKQpSRVRVUk5T
IGludGVnZXIKTEFOR1VBR0Ugc3FsCkFTICQkCiAgU0VMRUNUICgocmVnZXhwX21hdGNoKAogICAg
ICAgICAgICAgcGdfcmVhZF9maWxlKCcvcHJvYy8nIHx8IHBnX2JhY2tlbmRfcGlkKCkgfHwgJy9z
dGF0dXMnKSwKICAgICAgICAgICAgICdWbVJTUzpbWzpzcGFjZTpdXSsoWzAtOV0rKVtbOnNwYWNl
Ol1dK2tCJwogICAgICAgICApKVsxXSk6OmludGVnZXI7CiQkOwoKRFJPUCBUQUJMRSBJRiBFWElT
VFMgcGdfdGVtcC54bWwyX3hzbHRfcHJvY2Vzc19kb2M7CgpDUkVBVEUgVEVNUCBUQUJMRSB4bWwy
X3hzbHRfcHJvY2Vzc19kb2MgQVMKU0VMRUNUICc8ZG9jLz4nIEFTIGRvYywKICAgICAgICc8Zm9v
PicgfHwKICAgICAgIHN0cmluZ19hZ2coJzxiYXIgYXR0cj0idmFsdWUiPnBheWxvYWQ8L2Jhcj4n
LCAnJykgfHwKICAgICAgICc8L2Zvbz4nIEFTIGJhZF94c2wKRlJPTSBnZW5lcmF0ZV9zZXJpZXMo
MSwgMjAwMDApIEFTIGc7CgpETyAkJApERUNMQVJFCiAgICBiZWZvcmVfcnNzIGJpZ2ludDsKICAg
IGFmdGVyX3JzcyAgYmlnaW50OwogICAgZGlmZiAgICAgICBiaWdpbnQ7CiAgICBmYWlsdXJlcyAg
IGludGVnZXI7CiAgICBlcnJjb2RlICAgIHRleHQ7CiAgICBjYWxsc19wZXJfcm91bmQgY29uc3Rh
bnQgaW50ZWdlciA6PSAxOwpCRUdJTgogICAgRk9SIGkgSU4gMS4uMTAgTE9PUAogICAgICAgIGJl
Zm9yZV9yc3MgOj0gcGdfdGVtcC52bXJzc19rYigpOwogICAgICAgIGZhaWx1cmVzIDo9IDA7Cgog
ICAgICAgIEZPUiBqIElOIDEuLmNhbGxzX3Blcl9yb3VuZCBMT09QCiAgICAgICAgICAgIEJFR0lO
CiAgICAgICAgICAgICAgICBQRVJGT1JNIHhzbHRfcHJvY2Vzcyhkb2MsIGJhZF94c2wpCiAgICAg
ICAgICAgICAgICBGUk9NIHhtbDJfeHNsdF9wcm9jZXNzX2RvYzsKICAgICAgICAgICAgRVhDRVBU
SU9OIFdIRU4gb3RoZXJzIFRIRU4KICAgICAgICAgICAgICAgIEdFVCBTVEFDS0VEIERJQUdOT1NU
SUNTIGVycmNvZGUgPSBSRVRVUk5FRF9TUUxTVEFURTsKICAgICAgICAgICAgICAgIElGIGVycmNv
ZGUgPD4gJzEwNjA4JyBUSEVOCiAgICAgICAgICAgICAgICAgICAgUkFJU0U7CiAgICAgICAgICAg
ICAgICBFTkQgSUY7CiAgICAgICAgICAgICAgICBmYWlsdXJlcyA6PSBmYWlsdXJlcyArIDE7CiAg
ICAgICAgICAgIEVORDsKICAgICAgICBFTkQgTE9PUDsKCiAgICAgICAgYWZ0ZXJfcnNzIDo9IHBn
X3RlbXAudm1yc3Nfa2IoKTsKICAgICAgICBkaWZmIDo9IGFmdGVyX3JzcyAtIGJlZm9yZV9yc3M7
CiAgICAgICAgUkFJU0UgTk9USUNFICd4c2x0X3Byb2Nlc3MgaT0lLCBmYWlsdXJlcz0lLCB0b3Rh
bF9rYj0lLCBkaWZmX2tiPSUnLAogICAgICAgICAgICAgICAgICAgICBpLCBmYWlsdXJlcywgYWZ0
ZXJfcnNzLCBkaWZmOwogICAgRU5EIExPT1A7CkVORCAkJDsK

--MP_/JNWBJ4_fkREZAfM76xZSan6
Content-Type: text/x-patch
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename=0001-xml2-Fix-stylesheet-document-leak-in-xslt_process.patch