MIME-Version: 1.0
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Fri, 10 Apr 2026 19:27:58 +0530
Message-ID: 
 <CAJTYsWWzqpoRYxyA4ukjYpMPGEDgK2Za4t4wu9GdWOAtT8v-SQ@mail.gmail.com>
Subject: [PATCH] Fix NULL dereference in pg_get_database_ddl()
To: pgsql-hackers@postgresql.org
Content-Type: multipart/mixed; boundary="000000000000f8457d064f1b859c"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJTYsWWzqpoRYxyA4ukjYpMPGEDgK2Za4t4wu9GdWOAtT8v-SQ%40mail.gmail.com>
Precedence: bulk

--000000000000f8457d064f1b859c
Content-Type: multipart/alternative; boundary="000000000000f8457b064f1b859a"

--000000000000f8457b064f1b859a
Content-Type: text/plain; charset="UTF-8"

Hi,

pg_get_database_ddl_internal() can dereference a NULL pointer when
pg_database.dattablespace points to a tablespace OID that no longer
exists.

The immediate issue is that get_tablespace_name() may return NULL, but
the result is passed directly to pg_strcasecmp():

spcname = get_tablespace_name(dbform->dattablespace);
if (pg_strcasecmp(spcname, "pg_default") != 0)
...

That leads to a backend crash.  I reproduced it on current master as a
SIGSEGV with crash recovery.

This function was introduced by commit a4f774cf1c7.

Deterministic reproduction:

CREATE DATABASE regression_testdb;
SET allow_system_table_mods = on;
UPDATE pg_database
 SET dattablespace = 99999
 WHERE datname = 'regression_testdb';
RESET allow_system_table_mods;

SELECT * FROM pg_get_database_ddl('regression_testdb');

The attached patch fixes this by checking for NULL before calling
pg_strcasecmp().  In that case, pg_get_database_ddl() simply omits the
TABLESPACE clause.

I also added a regression test in database_ddl.sql that exercises this
case by setting dattablespace to a non-existent OID and verifying that
the function returns successfully.

Patch attached. Please review and let me know if it needs any edits. Thanks!

Regards,
Ayush Tiwari

--000000000000f8457b064f1b859a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>pg_get_database_ddl_internal() can dereference =
a NULL pointer when pg_database.dattablespace points to a tablespace OID th=
at no longer<br>exists.<br><br>The immediate issue is that get_tablespace_n=
ame() may return NULL, but<br>the result is passed directly to pg_strcasecm=
p():<br><br>	spcname =3D get_tablespace_name(dbform-&gt;dattablespace);<br>=
	if (pg_strcasecmp(spcname, &quot;pg_default&quot;) !=3D 0)<br>		...<br><br=
>That leads to a backend crash.=C2=A0 I reproduced it on current master as =
a<br>SIGSEGV with crash recovery.<br><br>This function was introduced by co=
mmit a4f774cf1c7.<br><br>Deterministic reproduction:<br><br>	CREATE DATABAS=
E regression_testdb;<br>	SET allow_system_table_mods =3D on;<br>	UPDATE pg_=
database<br>	 =C2=A0SET dattablespace =3D 99999<br>	 =C2=A0WHERE datname =
=3D &#39;regression_testdb&#39;;<br>	RESET allow_system_table_mods;<br><br>=
	SELECT * FROM pg_get_database_ddl(&#39;regression_testdb&#39;);<br><br>The=
 attached patch fixes this by checking for NULL before calling<br>pg_strcas=
ecmp().=C2=A0 In that case, pg_get_database_ddl() simply omits the<br>TABLE=
SPACE clause.<br><br>I also added a regression test in database_ddl.sql tha=
t exercises this<br>case by setting dattablespace to a non-existent OID and=
 verifying that<br>the function returns successfully.<br><br>Patch attached=
. Please review and let me know if it needs any edits. Thanks!<br><br>Regar=
ds,<br>Ayush Tiwari</div>

--000000000000f8457b064f1b859a--

--000000000000f8457d064f1b859c
Content-Type: application/octet-stream;
	name="0001-Fix-NULL-dereference-in-pg_get_database_ddl.patch"
Content-Disposition: attachment;
	filename="0001-Fix-NULL-dereference-in-pg_get_database_ddl.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mnsyvo7c0>
X-Attachment-Id: f_mnsyvo7c0

RnJvbSBlZDk0MzU3ZmJkNDdiOWMyOTQzNGU5MmI5ZWU2NWI0YmI4ZDNmNmYxIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBeXVzaCBUaXdhcmkgPGF5dXNodGl3YXJpLnNnbDAxQGdtYWls
LmNvbT4KRGF0ZTogRnJpLCAxMCBBcHIgMjAyNiAxOToxNzoxMiArMDUzMApTdWJqZWN0OiBbUEFU
Q0hdIEZpeCBOVUxMIGRlcmVmZXJlbmNlIGluIHBnX2dldF9kYXRhYmFzZV9kZGwoKQoKcGdfZ2V0
X2RhdGFiYXNlX2RkbF9pbnRlcm5hbCgpIGNhbiBkZXJlZmVyZW5jZSBhIE5VTEwgcG9pbnRlciB3
aGVuCnBnX2RhdGFiYXNlLmRhdHRhYmxlc3BhY2UgcG9pbnRzIHRvIGEgdGFibGVzcGFjZSBPSUQg
dGhhdCBubyBsb25nZXIKZXhpc3RzLgoKVGhlIGltbWVkaWF0ZSBpc3N1ZSBpcyB0aGF0IGdldF90
YWJsZXNwYWNlX25hbWUoKSBtYXkgcmV0dXJuIE5VTEwsIGJ1dAp0aGUgcmVzdWx0IGlzIHBhc3Nl
ZCBkaXJlY3RseSB0byBwZ19zdHJjYXNlY21wKCk6CgogICAgc3BjbmFtZSA9IGdldF90YWJsZXNw
YWNlX25hbWUoZGJmb3JtLT5kYXR0YWJsZXNwYWNlKTsKICAgIGlmIChwZ19zdHJjYXNlY21wKHNw
Y25hbWUsICJwZ19kZWZhdWx0IikgIT0gMCkKICAgICAgICAuLi4KClRoYXQgbGVhZHMgdG8gYSBi
YWNrZW5kIGNyYXNoIChTSUdTRUdWKS4KClRoaXMgZnVuY3Rpb24gd2FzIGludHJvZHVjZWQgYnkg
Y29tbWl0IGE0Zjc3NGNmMWM3LgoKVGhlIHBhdGNoIGZpeGVzIHRoaXMgYnkgY2hlY2tpbmcgZm9y
IE5VTEwgYmVmb3JlIGNhbGxpbmcKcGdfc3RyY2FzZWNtcCgpLiBJbiB0aGF0IGNhc2UsIHBnX2dl
dF9kYXRhYmFzZV9kZGwoKSBzaW1wbHkgb21pdHMgdGhlClRBQkxFU1BBQ0UgY2xhdXNlLgoKQSBy
ZWdyZXNzaW9uIHRlc3QgaXMgYWRkZWQgaW4gZGF0YWJhc2VfZGRsLnNxbCB0aGF0IGV4ZXJjaXNl
cyB0aGlzCmNhc2UgYnkgc2V0dGluZyBkYXR0YWJsZXNwYWNlIHRvIGEgbm9uLWV4aXN0ZW50IE9J
RCBhbmQgdmVyaWZ5aW5nIHRoYXQKdGhlIGZ1bmN0aW9uIHJldHVybnMgc3VjY2Vzc2Z1bGx5IHdp
dGhvdXQgY3Jhc2hpbmcuCi0tLQogc3JjL2JhY2tlbmQvdXRpbHMvYWR0L2RkbHV0aWxzLmMgICAg
ICAgICAgIHwgIDIgKy0KIHNyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvZGF0YWJhc2VfZGRsLm91
dCB8IDI0ICsrKysrKysrKysrKysrKysrKysrKysKIHNyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2RhdGFi
YXNlX2RkbC5zcWwgICAgICB8IDE3ICsrKysrKysrKysrKysrKwogMyBmaWxlcyBjaGFuZ2VkLCA0
MiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQv
dXRpbHMvYWR0L2RkbHV0aWxzLmMgYi9zcmMvYmFja2VuZC91dGlscy9hZHQvZGRsdXRpbHMuYwpp
bmRleCBiMTZjMjc3ZDAwMC4uYzU4ODViMTg5NTggMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL3V0
aWxzL2FkdC9kZGx1dGlscy5jCisrKyBiL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC9kZGx1dGlscy5j
CkBAIC05NzYsNyArOTc2LDcgQEAgcGdfZ2V0X2RhdGFiYXNlX2RkbF9pbnRlcm5hbChPaWQgZGJp
ZCwgYm9vbCBwcmV0dHksCiAJewogCQljaGFyCSAgICpzcGNuYW1lID0gZ2V0X3RhYmxlc3BhY2Vf
bmFtZShkYmZvcm0tPmRhdHRhYmxlc3BhY2UpOwogCi0JCWlmIChwZ19zdHJjYXNlY21wKHNwY25h
bWUsICJwZ19kZWZhdWx0IikgIT0gMCkKKwkJaWYgKHNwY25hbWUgIT0gTlVMTCAmJiBwZ19zdHJj
YXNlY21wKHNwY25hbWUsICJwZ19kZWZhdWx0IikgIT0gMCkKIAkJCWFwcGVuZF9kZGxfb3B0aW9u
KCZidWYsIHByZXR0eSwgNCwgIlRBQkxFU1BBQ0UgPSAlcyIsCiAJCQkJCQkJICBxdW90ZV9pZGVu
dGlmaWVyKHNwY25hbWUpKTsKIAl9CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9yZWdyZXNzL2V4cGVj
dGVkL2RhdGFiYXNlX2RkbC5vdXQgYi9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2RhdGFiYXNl
X2RkbC5vdXQKaW5kZXggOTc2NTdlNTJjZmEuLmJmZDdjZGNiYWNmIDEwMDY0NAotLS0gYS9zcmMv
dGVzdC9yZWdyZXNzL2V4cGVjdGVkL2RhdGFiYXNlX2RkbC5vdXQKKysrIGIvc3JjL3Rlc3QvcmVn
cmVzcy9leHBlY3RlZC9kYXRhYmFzZV9kZGwub3V0CkBAIC04Myw2ICs4MywzMCBAQCBFUlJPUjog
IHBlcm1pc3Npb24gZGVuaWVkIGZvciBkYXRhYmFzZSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbAog
UkVTRVQgUk9MRTsKIEdSQU5UIENPTk5FQ1QgT04gREFUQUJBU0UgcmVncmVzc2lvbl9kYXRhYmFz
ZV9kZGwgVE8gUFVCTElDOwogRFJPUCBST0xFIHJlZ3Jlc3NfZGJfZGRsX25vYWNjZXNzOworLS0g
VGVzdCBmb3IgZHJvcHBlZCB0YWJsZXNwYWNlOiBkYXR0YWJsZXNwYWNlIHBvaW50aW5nIHRvIGEg
bm9uLWV4aXN0ZW50IE9JRAorLS0gc2hvdWxkIG5vdCBjcmFzaCAoc2VlIGNvbW1pdCBmaXhpbmcg
TlVMTCBkZXJlZiBpbiBwZ19nZXRfZGF0YWJhc2VfZGRsX2ludGVybmFsKQorQ1JFQVRFIERBVEFC
QVNFIHJlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsMgorICBFTkNPRElORyB1dGY4IExDX0NPTExBVEUg
IkMiIExDX0NUWVBFICJDIiBURU1QTEFURSB0ZW1wbGF0ZTAKKyAgT1dORVIgcmVncmVzc19kYXRk
YmE7CitTRVQgYWxsb3dfc3lzdGVtX3RhYmxlX21vZHMgPSBvbjsKK1VQREFURSBwZ19kYXRhYmFz
ZSBTRVQgZGF0dGFibGVzcGFjZSA9IDk5OTk5CisgICAgV0hFUkUgZGF0bmFtZSA9ICdyZWdyZXNz
aW9uX2RhdGFiYXNlX2RkbDInOworVVBEQVRFIDEKK1JFU0VUIGFsbG93X3N5c3RlbV90YWJsZV9t
b2RzOworU0VMRUNUIGRkbF9maWx0ZXIocGdfZ2V0X2RhdGFiYXNlX2RkbCkgRlJPTSBwZ19nZXRf
ZGF0YWJhc2VfZGRsKCdyZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDInKTsKKyAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBkZGxfZmlsdGVyICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIAorLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCisg
Q1JFQVRFIERBVEFCQVNFIHJlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsMiBXSVRIIFRFTVBMQVRFID0g
dGVtcGxhdGUwIEVOQ09ESU5HID0gJ1VURjgnOworIEFMVEVSIERBVEFCQVNFIHJlZ3Jlc3Npb25f
ZGF0YWJhc2VfZGRsMiBPV05FUiBUTyByZWdyZXNzX2RhdGRiYTsKKygyIHJvd3MpCisKK1NFVCBh
bGxvd19zeXN0ZW1fdGFibGVfbW9kcyA9IG9uOworVVBEQVRFIHBnX2RhdGFiYXNlIFNFVCBkYXR0
YWJsZXNwYWNlID0KKyAgKFNFTEVDVCBvaWQgRlJPTSBwZ190YWJsZXNwYWNlIFdIRVJFIHNwY25h
bWUgPSAncGdfZGVmYXVsdCcpCisgICAgV0hFUkUgZGF0bmFtZSA9ICdyZWdyZXNzaW9uX2RhdGFi
YXNlX2RkbDInOworVVBEQVRFIDEKK1JFU0VUIGFsbG93X3N5c3RlbV90YWJsZV9tb2RzOworRFJP
UCBEQVRBQkFTRSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDI7CiBEUk9QIERBVEFCQVNFIHJlZ3Jl
c3Npb25fZGF0YWJhc2VfZGRsOwogRFJPUCBGVU5DVElPTiBkZGxfZmlsdGVyKHRleHQpOwogRFJP
UCBST0xFIHJlZ3Jlc3NfZGF0ZGJhOwpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvcmVncmVzcy9zcWwv
ZGF0YWJhc2VfZGRsLnNxbCBiL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2RhdGFiYXNlX2RkbC5zcWwK
aW5kZXggODk3NTNhYzY0MTEuLjA3OTJhNGE5ZjM1IDEwMDY0NAotLS0gYS9zcmMvdGVzdC9yZWdy
ZXNzL3NxbC9kYXRhYmFzZV9kZGwuc3FsCisrKyBiL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2RhdGFi
YXNlX2RkbC5zcWwKQEAgLTYxLDYgKzYxLDIzIEBAIFJFU0VUIFJPTEU7CiBHUkFOVCBDT05ORUNU
IE9OIERBVEFCQVNFIHJlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsIFRPIFBVQkxJQzsKIERST1AgUk9M
RSByZWdyZXNzX2RiX2RkbF9ub2FjY2VzczsKIAorLS0gVGVzdCBmb3IgZHJvcHBlZCB0YWJsZXNw
YWNlOiBkYXR0YWJsZXNwYWNlIHBvaW50aW5nIHRvIGEgbm9uLWV4aXN0ZW50IE9JRAorLS0gc2hv
dWxkIG5vdCBjcmFzaCAoc2VlIGNvbW1pdCBmaXhpbmcgTlVMTCBkZXJlZiBpbiBwZ19nZXRfZGF0
YWJhc2VfZGRsX2ludGVybmFsKQorQ1JFQVRFIERBVEFCQVNFIHJlZ3Jlc3Npb25fZGF0YWJhc2Vf
ZGRsMgorICBFTkNPRElORyB1dGY4IExDX0NPTExBVEUgIkMiIExDX0NUWVBFICJDIiBURU1QTEFU
RSB0ZW1wbGF0ZTAKKyAgT1dORVIgcmVncmVzc19kYXRkYmE7CitTRVQgYWxsb3dfc3lzdGVtX3Rh
YmxlX21vZHMgPSBvbjsKK1VQREFURSBwZ19kYXRhYmFzZSBTRVQgZGF0dGFibGVzcGFjZSA9IDk5
OTk5CisgICAgV0hFUkUgZGF0bmFtZSA9ICdyZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDInOworUkVT
RVQgYWxsb3dfc3lzdGVtX3RhYmxlX21vZHM7CitTRUxFQ1QgZGRsX2ZpbHRlcihwZ19nZXRfZGF0
YWJhc2VfZGRsKSBGUk9NIHBnX2dldF9kYXRhYmFzZV9kZGwoJ3JlZ3Jlc3Npb25fZGF0YWJhc2Vf
ZGRsMicpOworU0VUIGFsbG93X3N5c3RlbV90YWJsZV9tb2RzID0gb247CitVUERBVEUgcGdfZGF0
YWJhc2UgU0VUIGRhdHRhYmxlc3BhY2UgPQorICAoU0VMRUNUIG9pZCBGUk9NIHBnX3RhYmxlc3Bh
Y2UgV0hFUkUgc3BjbmFtZSA9ICdwZ19kZWZhdWx0JykKKyAgICBXSEVSRSBkYXRuYW1lID0gJ3Jl
Z3Jlc3Npb25fZGF0YWJhc2VfZGRsMic7CitSRVNFVCBhbGxvd19zeXN0ZW1fdGFibGVfbW9kczsK
K0RST1AgREFUQUJBU0UgcmVncmVzc2lvbl9kYXRhYmFzZV9kZGwyOworCiBEUk9QIERBVEFCQVNF
IHJlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsOwogRFJPUCBGVU5DVElPTiBkZGxfZmlsdGVyKHRleHQp
OwogRFJPUCBST0xFIHJlZ3Jlc3NfZGF0ZGJhOwotLSAKMi41My4wLndpbmRvd3MuMgoK
--000000000000f8457d064f1b859c--