MIME-Version: 1.0
From: SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>
Date: Thu, 16 Apr 2026 10:09:40 -0700
Message-ID: 
 <CAHg+QDdej0c0gWJi2FnbirzhgzyZNPiTwC1P5B_-dSNCzq-91A@mail.gmail.com>
Subject: COPY FROM ON_ERROR SET_NULL bypasses domain NOT NULL with partial
 column list
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: jian he <jian.universality@gmail.com>
Content-Type: multipart/mixed; boundary="0000000000008eda9f064f96e672"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHg%2BQDdej0c0gWJi2FnbirzhgzyZNPiTwC1P5B_-dSNCzq-91A%40mail.gmail.com>
Precedence: bulk

--0000000000008eda9f064f96e672
Content-Type: multipart/alternative; boundary="0000000000008eda9e064f96e670"

--0000000000008eda9e064f96e670
Content-Type: text/plain; charset="UTF-8"

HI hackers,

domain_with_constraint[] was allocated with list_length(attnumlist)
elements and indexed sequentially via foreach_current_index(), but
copyfromparse.c accesses it via attnum - 1 (physical attribute index).
With a partial column list targeting high-numbered columns, this caused
an out-of-bounds read that bypassed domain NOT NULL checks, silently
inserting NULL into NOT NULL domain columns.

Fix by allocating with num_phys_attrs and indexing by attnum - 1,
consistent with all other per-column arrays in BeginCopyFrom().

Patch is attached, and added a new test case to cover this scenario.

Repro:

CREATE DOMAIN d_notnull_int AS int NOT NULL;
CREATE TABLE t (
    c1 text, c2 text, c3 text, c4 text, c5 text,
    c6 text, c7 text, c8 text, c9 text,
    c10 d_notnull_int
);

COPY t(c1, c10) FROM stdin WITH (on_error set_null);
hello    bad
\.

SELECT c10 IS NULL FROM t;

Thanks,
Satya

--0000000000008eda9e064f96e670
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">HI hackers,<div><br></div><div>domain_with_constraint[] wa=
s allocated with list_length(attnumlist)<br>elements and indexed sequential=
ly via foreach_current_index(), but<br>copyfromparse.c accesses it via attn=
um - 1 (physical attribute index).<br>With a partial column list targeting =
high-numbered columns, this caused<br>an out-of-bounds read that bypassed d=
omain NOT NULL checks, silently<br>inserting NULL into NOT NULL domain colu=
mns.<br><br>Fix by allocating with num_phys_attrs and indexing by attnum - =
1,<br>consistent with all other per-column arrays in BeginCopyFrom().</div>=
<div><br></div><div>Patch is attached, and added a new test case to cover t=
his scenario.</div><div><br></div><div>Repro:</div><div><br></div><div>CREA=
TE DOMAIN d_notnull_int AS int NOT NULL;<br>CREATE TABLE t (<br>=C2=A0 =C2=
=A0 c1 text, c2 text, c3 text, c4 text, c5 text,<br>=C2=A0 =C2=A0 c6 text, =
c7 text, c8 text, c9 text,<br>=C2=A0 =C2=A0 c10 d_notnull_int<br>);<br><br>=
COPY t(c1, c10) FROM stdin WITH (on_error set_null);<br>hello=C2=A0 =C2=A0 =
bad<br>\.<br><br>SELECT c10 IS NULL FROM t;=C2=A0</div><div><br></div><div>=
Thanks,</div><div>Satya</div><div><br></div><div><br></div></div>

--0000000000008eda9e064f96e670--

--0000000000008eda9f064f96e672
Content-Type: application/octet-stream;
	name="0001-Fix-COPY-FROM-ON_ERROR-SET_NULL-OOB-read-with-partia.patch"
Content-Disposition: attachment;
	filename="0001-Fix-COPY-FROM-ON_ERROR-SET_NULL-OOB-read-with-partia.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mo1qh3ce0>
X-Attachment-Id: f_mo1qh3ce0

RnJvbSBmZjllNTgyMzE2NDcxNGUxNGNiYTVlNzAwOTljMDUxYmMyNTcxZTcwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBTYXR5YSBOYXJsYXB1cmFtIDxzYXR5YW5hcmFsYXB1cmFtQGdt
YWlsLmNvbT4KRGF0ZTogVGh1LCAxNiBBcHIgMjAyNiAxNjo0MzozNCArMDAwMApTdWJqZWN0OiBb
UEFUQ0hdIEZpeCBDT1BZIEZST00gT05fRVJST1IgU0VUX05VTEwgT09CIHJlYWQgd2l0aCBwYXJ0
aWFsIGNvbHVtbgogbGlzdAoKZG9tYWluX3dpdGhfY29uc3RyYWludFtdIHdhcyBhbGxvY2F0ZWQg
d2l0aCBsaXN0X2xlbmd0aChhdHRudW1saXN0KQplbGVtZW50cyBhbmQgaW5kZXhlZCBzZXF1ZW50
aWFsbHkgdmlhIGZvcmVhY2hfY3VycmVudF9pbmRleCgpLCBidXQKY29weWZyb21wYXJzZS5jIGFj
Y2Vzc2VzIGl0IHZpYSBhdHRudW0gLSAxIChwaHlzaWNhbCBhdHRyaWJ1dGUgaW5kZXgpLgpXaXRo
IGEgcGFydGlhbCBjb2x1bW4gbGlzdCB0YXJnZXRpbmcgaGlnaC1udW1iZXJlZCBjb2x1bW5zLCB0
aGlzIGNhdXNlZAphbiBvdXQtb2YtYm91bmRzIHJlYWQgdGhhdCBieXBhc3NlZCBkb21haW4gTk9U
IE5VTEwgY2hlY2tzLCBzaWxlbnRseQppbnNlcnRpbmcgTlVMTCBpbnRvIE5PVCBOVUxMIGRvbWFp
biBjb2x1bW5zLgoKRml4IGJ5IGFsbG9jYXRpbmcgd2l0aCBudW1fcGh5c19hdHRycyBhbmQgaW5k
ZXhpbmcgYnkgYXR0bnVtIC0gMSwKY29uc2lzdGVudCB3aXRoIGFsbCBvdGhlciBwZXItY29sdW1u
IGFycmF5cyBpbiBCZWdpbkNvcHlGcm9tKCkuCi0tLQogc3JjL2JhY2tlbmQvY29tbWFuZHMvY29w
eWZyb20uYyAgICAgfCAgOCArKy0tLS0tLQogc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9jb3B5
Mi5vdXQgfCAyMyArKysrKysrKysrKysrKysrKysrKysrKwogc3JjL3Rlc3QvcmVncmVzcy9zcWwv
Y29weTIuc3FsICAgICAgfCAxOSArKysrKysrKysrKysrKysrKysrCiAzIGZpbGVzIGNoYW5nZWQs
IDQ0IGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tl
bmQvY29tbWFuZHMvY29weWZyb20uYyBiL3NyYy9iYWNrZW5kL2NvbW1hbmRzL2NvcHlmcm9tLmMK
aW5kZXggNjRhYzMwNjMuLjAwODc1ODViIDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC9jb21tYW5k
cy9jb3B5ZnJvbS5jCisrKyBiL3NyYy9iYWNrZW5kL2NvbW1hbmRzL2NvcHlmcm9tLmMKQEAgLTE2
MzYsOCArMTYzNiw2IEBAIEJlZ2luQ29weUZyb20oUGFyc2VTdGF0ZSAqcHN0YXRlLAogCiAJaWYg
KGNzdGF0ZS0+b3B0cy5vbl9lcnJvciA9PSBDT1BZX09OX0VSUk9SX1NFVF9OVUxMKQogCXsKLQkJ
aW50CQkJYXR0cl9jb3VudCA9IGxpc3RfbGVuZ3RoKGNzdGF0ZS0+YXR0bnVtbGlzdCk7Ci0KIAkJ
LyoKIAkJICogV2hlbiBkYXRhIHR5cGUgY29udmVyc2lvbiBmYWlscyBhbmQgT05fRVJST1IgaXMg
U0VUX05VTEwsIHdlIG5lZWQKIAkJICogZW5zdXJlIHRoYXQgdGhlIGlucHV0IGNvbHVtbiBhbGxv
dyBudWxsIHZhbHVlcy4gIEV4ZWNDb25zdHJhaW50cygpCkBAIC0xNjQ2LDE1ICsxNjQ0LDEzIEBA
IEJlZ2luQ29weUZyb20oUGFyc2VTdGF0ZSAqcHN0YXRlLAogCQkgKiBjaGVjayBtdXN0IGJlIHBl
cmZvcm1lZCBkdXJpbmcgdGhlIGluaXRpYWwgc3RyaW5nLXRvLWRhdHVtCiAJCSAqIGNvbnZlcnNp
b24gKHNlZSBDb3B5RnJvbVRleHRMaWtlT25lUm93KCkpLgogCQkgKi8KLQkJY3N0YXRlLT5kb21h
aW5fd2l0aF9jb25zdHJhaW50ID0gcGFsbG9jMF9hcnJheShib29sLCBhdHRyX2NvdW50KTsKKwkJ
Y3N0YXRlLT5kb21haW5fd2l0aF9jb25zdHJhaW50ID0gcGFsbG9jMF9hcnJheShib29sLCBudW1f
cGh5c19hdHRycyk7CiAKIAkJZm9yZWFjaF9pbnQoYXR0bm8sIGNzdGF0ZS0+YXR0bnVtbGlzdCkK
IAkJewotCQkJaW50CQkJaSA9IGZvcmVhY2hfY3VycmVudF9pbmRleChhdHRubyk7Ci0KIAkJCUZv
cm1fcGdfYXR0cmlidXRlIGF0dCA9IFR1cGxlRGVzY0F0dHIodHVwRGVzYywgYXR0bm8gLSAxKTsK
IAotCQkJY3N0YXRlLT5kb21haW5fd2l0aF9jb25zdHJhaW50W2ldID0gRG9tYWluSGFzQ29uc3Ry
YWludHMoYXR0LT5hdHR0eXBpZCwgTlVMTCk7CisJCQljc3RhdGUtPmRvbWFpbl93aXRoX2NvbnN0
cmFpbnRbYXR0bm8gLSAxXSA9IERvbWFpbkhhc0NvbnN0cmFpbnRzKGF0dC0+YXR0dHlwaWQsIE5V
TEwpOwogCQl9CiAJfQogCmRpZmYgLS1naXQgYS9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2Nv
cHkyLm91dCBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvY29weTIub3V0CmluZGV4IDc2MDBl
NTIzLi4yZDZiZmRkOCAxMDA2NDQKLS0tIGEvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9jb3B5
Mi5vdXQKKysrIGIvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9jb3B5Mi5vdXQKQEAgLTgzOSw2
ICs4MzksMjggQEAgU0VMRUNUICogRlJPTSB0X29uX2Vycm9yX251bGwgT1JERVIgQlkgYTsKICAx
MyB8ICAgMTQgfCBOVUxMCiAoMyByb3dzKQogCistLSBUZXN0IG9uX2Vycm9yIHNldF9udWxsIHdp
dGggcGFydGlhbCBjb2x1bW4gbGlzdCBhbmQgZG9tYWluIE5PVCBOVUxMLgorLS0gQnVnOiBkb21h
aW5fd2l0aF9jb25zdHJhaW50W10gd2FzIGluZGV4ZWQgYnkgcGh5c2ljYWwgYXR0bnVtLCBidXQK
Ky0tIGFsbG9jYXRlZCB3aXRoIG9ubHkgYXMgbWFueSBlbGVtZW50cyBhcyB0aGUgQ09QWSBjb2x1
bW4gbGlzdC4KKy0tIFdpdGggYSBwYXJ0aWFsIGNvbHVtbiBsaXN0IHRhcmdldGluZyBhIGhpZ2gt
bnVtYmVyZWQgY29sdW1uLCB0aGlzCistLSBjYXVzZWQgYW4gb3V0LW9mLWJvdW5kcyByZWFkIHRo
YXQgYnlwYXNzZWQgdGhlIGRvbWFpbiBOT1QgTlVMTCBjaGVjay4KK0NSRUFURSBUQUJMRSB0X29u
X2Vycm9yX251bGxfcGFydGlhbCAoCisgICAgYzEgdGV4dCwgYzIgdGV4dCwgYzMgdGV4dCwgYzQg
dGV4dCwgYzUgdGV4dCwKKyAgICBjNiB0ZXh0LCBjNyB0ZXh0LCBjOCB0ZXh0LCBjOSB0ZXh0LAor
ICAgIGMxMCBkX2ludF9ub3RfbnVsbCAgIC0tIGF0dG51bSAxMCwgZG9tYWluIE5PVCBOVUxMCisp
OworLS0gUGFydGlhbCBjb2x1bW4gbGlzdDogYXR0bnVtbGlzdCA9IHsxLCAxMH0uICBTaG91bGQg
ZmFpbCBiZWNhdXNlCistLSB0aGUgZG9tYWluIG9uIGMxMCBkb2VzIG5vdCBhbGxvdyBudWxsLCBh
bmQgJ2JhZCcgaXMgbm90IGFuIGludGVnZXIuCitDT1BZIHRfb25fZXJyb3JfbnVsbF9wYXJ0aWFs
KGMxLCBjMTApIEZST00gU1RESU4gV0lUSCAob25fZXJyb3Igc2V0X251bGwpOyAtLSBmYWlsCitF
UlJPUjogIGRvbWFpbiBkX2ludF9ub3RfbnVsbCBkb2VzIG5vdCBhbGxvdyBudWxsIHZhbHVlcwor
REVUQUlMOiAgT05fRVJST1IgU0VUX05VTEwgY2Fubm90IGJlIGFwcGxpZWQgYmVjYXVzZSBjb2x1
bW4gImMxMCIgKGRvbWFpbiBkX2ludF9ub3RfbnVsbCkgZG9lcyBub3QgYWNjZXB0IG51bGwgdmFs
dWVzLgorQ09OVEVYVDogIENPUFkgdF9vbl9lcnJvcl9udWxsX3BhcnRpYWwsIGxpbmUgMSwgY29s
dW1uIGMxMDogImJhZCIKK1NFTEVDVCBjb3VudCgqKSBBUyAiZXhwZWN0XzAiIEZST00gdF9vbl9l
cnJvcl9udWxsX3BhcnRpYWw7CisgZXhwZWN0XzAgCistLS0tLS0tLS0tCisgICAgICAgIDAKKygx
IHJvdykKKwogXHBzZXQgbnVsbCAnJwogLS0gdGVzdHMgZm9yIG9uX2Vycm9yIG9wdGlvbiB3aXRo
IGxvZ192ZXJib3NpdHkgYW5kIG51bGwgY29uc3RyYWludCB2aWEgZG9tYWluCiBDUkVBVEUgRE9N
QUlOIGRjaGVja19pZ25fZXJyMiB2YXJjaGFyKDE1KSBOT1QgTlVMTDsKQEAgLTkwMCw2ICs5MjIs
NyBAQCBEUk9QIFZJRVcgaW5zdGVhZF9vZl9pbnNlcnRfdGJsX3ZpZXdfMjsKIERST1AgRlVOQ1RJ
T04gZnVuX2luc3RlYWRfb2ZfaW5zZXJ0X3RibCgpOwogRFJPUCBUQUJMRSBjaGVja19pZ25fZXJy
OwogRFJPUCBUQUJMRSB0X29uX2Vycm9yX251bGw7CitEUk9QIFRBQkxFIHRfb25fZXJyb3JfbnVs
bF9wYXJ0aWFsOwogRFJPUCBET01BSU4gZF9pbnRfbm90X251bGw7CiBEUk9QIERPTUFJTiBkX2lu
dF9wb3NpdGl2ZV9tYXliZV9udWxsOwogRFJPUCBUQUJMRSBjaGVja19pZ25fZXJyMjsKZGlmZiAt
LWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2NvcHkyLnNxbCBiL3NyYy90ZXN0L3JlZ3Jlc3Mv
c3FsL2NvcHkyLnNxbAppbmRleCBlMDgxMDEwOS4uMjg3YzhmYjggMTAwNjQ0Ci0tLSBhL3NyYy90
ZXN0L3JlZ3Jlc3Mvc3FsL2NvcHkyLnNxbAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9jb3B5
Mi5zcWwKQEAgLTU4MCw2ICs1ODAsMjQgQEAgQ09QWSB0X29uX2Vycm9yX251bGwgRlJPTSBTVERJ
TiBXSVRIIChvbl9lcnJvciBzZXRfbnVsbCwgbG9nX3ZlcmJvc2l0eSB2ZXJib3NlKTsKIAogU0VM
RUNUICogRlJPTSB0X29uX2Vycm9yX251bGwgT1JERVIgQlkgYTsKIAorLS0gVGVzdCBvbl9lcnJv
ciBzZXRfbnVsbCB3aXRoIHBhcnRpYWwgY29sdW1uIGxpc3QgYW5kIGRvbWFpbiBOT1QgTlVMTC4K
Ky0tIEJ1ZzogZG9tYWluX3dpdGhfY29uc3RyYWludFtdIHdhcyBpbmRleGVkIGJ5IHBoeXNpY2Fs
IGF0dG51bSwgYnV0CistLSBhbGxvY2F0ZWQgd2l0aCBvbmx5IGFzIG1hbnkgZWxlbWVudHMgYXMg
dGhlIENPUFkgY29sdW1uIGxpc3QuCistLSBXaXRoIGEgcGFydGlhbCBjb2x1bW4gbGlzdCB0YXJn
ZXRpbmcgYSBoaWdoLW51bWJlcmVkIGNvbHVtbiwgdGhpcworLS0gY2F1c2VkIGFuIG91dC1vZi1i
b3VuZHMgcmVhZCB0aGF0IGJ5cGFzc2VkIHRoZSBkb21haW4gTk9UIE5VTEwgY2hlY2suCitDUkVB
VEUgVEFCTEUgdF9vbl9lcnJvcl9udWxsX3BhcnRpYWwgKAorICAgIGMxIHRleHQsIGMyIHRleHQs
IGMzIHRleHQsIGM0IHRleHQsIGM1IHRleHQsCisgICAgYzYgdGV4dCwgYzcgdGV4dCwgYzggdGV4
dCwgYzkgdGV4dCwKKyAgICBjMTAgZF9pbnRfbm90X251bGwgICAtLSBhdHRudW0gMTAsIGRvbWFp
biBOT1QgTlVMTAorKTsKKy0tIFBhcnRpYWwgY29sdW1uIGxpc3Q6IGF0dG51bWxpc3QgPSB7MSwg
MTB9LiAgU2hvdWxkIGZhaWwgYmVjYXVzZQorLS0gdGhlIGRvbWFpbiBvbiBjMTAgZG9lcyBub3Qg
YWxsb3cgbnVsbCwgYW5kICdiYWQnIGlzIG5vdCBhbiBpbnRlZ2VyLgorQ09QWSB0X29uX2Vycm9y
X251bGxfcGFydGlhbChjMSwgYzEwKSBGUk9NIFNURElOIFdJVEggKG9uX2Vycm9yIHNldF9udWxs
KTsgLS0gZmFpbAoraGVsbG8JYmFkCitcLgorCitTRUxFQ1QgY291bnQoKikgQVMgImV4cGVjdF8w
IiBGUk9NIHRfb25fZXJyb3JfbnVsbF9wYXJ0aWFsOworCiBccHNldCBudWxsICcnCiAKIC0tIHRl
c3RzIGZvciBvbl9lcnJvciBvcHRpb24gd2l0aCBsb2dfdmVyYm9zaXR5IGFuZCBudWxsIGNvbnN0
cmFpbnQgdmlhIGRvbWFpbgpAQCAtNjUyLDYgKzY3MCw3IEBAIERST1AgVklFVyBpbnN0ZWFkX29m
X2luc2VydF90Ymxfdmlld18yOwogRFJPUCBGVU5DVElPTiBmdW5faW5zdGVhZF9vZl9pbnNlcnRf
dGJsKCk7CiBEUk9QIFRBQkxFIGNoZWNrX2lnbl9lcnI7CiBEUk9QIFRBQkxFIHRfb25fZXJyb3Jf
bnVsbDsKK0RST1AgVEFCTEUgdF9vbl9lcnJvcl9udWxsX3BhcnRpYWw7CiBEUk9QIERPTUFJTiBk
X2ludF9ub3RfbnVsbDsKIERST1AgRE9NQUlOIGRfaW50X3Bvc2l0aXZlX21heWJlX251bGw7CiBE
Uk9QIFRBQkxFIGNoZWNrX2lnbl9lcnIyOwotLSAKMi40My4wCgo=
--0000000000008eda9f064f96e672--