MIME-Version: 1.0
References: 
 <CAJTYsWWzqpoRYxyA4ukjYpMPGEDgK2Za4t4wu9GdWOAtT8v-SQ@mail.gmail.com>
In-Reply-To: 
 <CAJTYsWWzqpoRYxyA4ukjYpMPGEDgK2Za4t4wu9GdWOAtT8v-SQ@mail.gmail.com>
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Fri, 10 Apr 2026 19:43:10 +0530
Message-ID: 
 <CAJTYsWXA0QBaMRZG_TK4K9sK59snU6YZC6+raT00Y=oMdYCT7A@mail.gmail.com>
Subject: Re: [PATCH] Fix NULL dereference in pg_get_database_ddl()
To: pgsql-hackers@postgresql.org
Content-Type: multipart/mixed; boundary="0000000000004a77a8064f1bbc10"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJTYsWXA0QBaMRZG_TK4K9sK59snU6YZC6%2BraT00Y%3DoMdYCT7A%40mail.gmail.com>
Precedence: bulk

--0000000000004a77a8064f1bbc10
Content-Type: multipart/alternative; boundary="0000000000004a77a4064f1bbc0e"

--0000000000004a77a4064f1bbc0e
Content-Type: text/plain; charset="UTF-8"

On Fri, 10 Apr 2026 at 19:27, Ayush Tiwari <ayushtiwari.slg01@gmail.com>
wrote:

> Hi,
>
> pg_get_database_ddl_internal() can dereference a NULL pointer when
> pg_database.dattablespace points to a tablespace OID that no longer
> exists.
>
> The immediate issue is that get_tablespace_name() may return NULL, but
> the result is passed directly to pg_strcasecmp():
>
> spcname = get_tablespace_name(dbform->dattablespace);
> if (pg_strcasecmp(spcname, "pg_default") != 0)
> ...
>
> That leads to a backend crash.  I reproduced it on current master as a
> SIGSEGV with crash recovery.
>
> This function was introduced by commit a4f774cf1c7.
>
> Deterministic reproduction:
>
> CREATE DATABASE regression_testdb;
> SET allow_system_table_mods = on;
> UPDATE pg_database
>  SET dattablespace = 99999
>  WHERE datname = 'regression_testdb';
> RESET allow_system_table_mods;
>
> SELECT * FROM pg_get_database_ddl('regression_testdb');
>
> The attached patch fixes this by checking for NULL before calling
> pg_strcasecmp().  In that case, pg_get_database_ddl() simply omits the
> TABLESPACE clause.
>
> I also added a regression test in database_ddl.sql that exercises this
> case by setting dattablespace to a non-existent OID and verifying that
> the function returns successfully.
>
> Patch attached. Please review and let me know if it needs any edits.
> Thanks!
>
> Regards,
> Ayush Tiwari
>

Re-attaching patch without trailing white-space

Regards,
Ayush

--0000000000004a77a4064f1bbc0e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, 10 Apr =
2026 at 19:27, Ayush Tiwari &lt;<a href=3D"mailto:ayushtiwari.slg01@gmail.c=
om">ayushtiwari.slg01@gmail.com</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div dir=3D"ltr">Hi,<br><br>pg_get_databas=
e_ddl_internal() can dereference a NULL pointer when pg_database.dattablesp=
ace points to a tablespace OID that no longer<br>exists.<br><br>The immedia=
te issue is that get_tablespace_name() may return NULL, but<br>the result i=
s passed directly to pg_strcasecmp():<br><br>	spcname =3D get_tablespace_na=
me(dbform-&gt;dattablespace);<br>	if (pg_strcasecmp(spcname, &quot;pg_defau=
lt&quot;) !=3D 0)<br>		...<br><br>That leads to a backend crash.=C2=A0 I re=
produced it on current master as a<br>SIGSEGV with crash recovery.<br><br>T=
his function was introduced by commit a4f774cf1c7.<br><br>Deterministic rep=
roduction:<br><br>	CREATE DATABASE regression_testdb;<br>	SET allow_system_=
table_mods =3D on;<br>	UPDATE pg_database<br>	 =C2=A0SET dattablespace =3D =
99999<br>	 =C2=A0WHERE datname =3D &#39;regression_testdb&#39;;<br>	RESET a=
llow_system_table_mods;<br><br>	SELECT * FROM pg_get_database_ddl(&#39;regr=
ession_testdb&#39;);<br><br>The attached patch fixes this by checking for N=
ULL before calling<br>pg_strcasecmp().=C2=A0 In that case, pg_get_database_=
ddl() simply omits the<br>TABLESPACE clause.<br><br>I also added a regressi=
on test in database_ddl.sql that exercises this<br>case by setting dattable=
space to a non-existent OID and verifying that<br>the function returns succ=
essfully.<br><br>Patch attached. Please review and let me know if it needs =
any edits. Thanks!<br><br>Regards,<br>Ayush Tiwari</div></blockquote><div><=
br></div>Re-attaching patch without trailing white-space<br><br>Regards,<br=
><div>Ayush=C2=A0</div></div></div>

--0000000000004a77a4064f1bbc0e--

--0000000000004a77a8064f1bbc10
Content-Type: application/octet-stream;
	name="0001-Fix-NULL-dereference-in-pg_get_database_ddl.patch"
Content-Disposition: attachment;
	filename="0001-Fix-NULL-dereference-in-pg_get_database_ddl.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mnszivn40>
X-Attachment-Id: f_mnszivn40

RnJvbSAyZDM1OGFjNDhjOTQ1MjA2Mjg2ODJkZjFmMzY2NjFmZDI0MjkyZTc2IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBeXVzaCBUaXdhcmkgPGF5dGl3YXJpQG1pY3Jvc29mdC5jb20+
CkRhdGU6IEZyaSwgMTAgQXByIDIwMjYgMTk6MTc6MTIgKzA1MzAKU3ViamVjdDogW1BBVENIXSBG
aXggTlVMTCBkZXJlZmVyZW5jZSBpbiBwZ19nZXRfZGF0YWJhc2VfZGRsKCkKCnBnX2dldF9kYXRh
YmFzZV9kZGxfaW50ZXJuYWwoKSBjYW4gZGVyZWZlcmVuY2UgYSBOVUxMIHBvaW50ZXIgd2hlbgpw
Z19kYXRhYmFzZS5kYXR0YWJsZXNwYWNlIHBvaW50cyB0byBhIHRhYmxlc3BhY2UgT0lEIHRoYXQg
bm8gbG9uZ2VyCmV4aXN0cy4KClRoZSBpbW1lZGlhdGUgaXNzdWUgaXMgdGhhdCBnZXRfdGFibGVz
cGFjZV9uYW1lKCkgbWF5IHJldHVybiBOVUxMLCBidXQKdGhlIHJlc3VsdCBpcyBwYXNzZWQgZGly
ZWN0bHkgdG8gcGdfc3RyY2FzZWNtcCgpOgoKICAgIHNwY25hbWUgPSBnZXRfdGFibGVzcGFjZV9u
YW1lKGRiZm9ybS0+ZGF0dGFibGVzcGFjZSk7CiAgICBpZiAocGdfc3RyY2FzZWNtcChzcGNuYW1l
LCAicGdfZGVmYXVsdCIpICE9IDApCiAgICAgICAgLi4uCgpUaGF0IGxlYWRzIHRvIGEgYmFja2Vu
ZCBjcmFzaCAoU0lHU0VHVikuCgpUaGlzIGZ1bmN0aW9uIHdhcyBpbnRyb2R1Y2VkIGJ5IGNvbW1p
dCBhNGY3NzRjZjFjNy4KClRoZSBwYXRjaCBmaXhlcyB0aGlzIGJ5IGNoZWNraW5nIGZvciBOVUxM
IGJlZm9yZSBjYWxsaW5nCnBnX3N0cmNhc2VjbXAoKS4gSW4gdGhhdCBjYXNlLCBwZ19nZXRfZGF0
YWJhc2VfZGRsKCkgc2ltcGx5IG9taXRzIHRoZQpUQUJMRVNQQUNFIGNsYXVzZS4KCkEgcmVncmVz
c2lvbiB0ZXN0IGlzIGFkZGVkIGluIGRhdGFiYXNlX2RkbC5zcWwgdGhhdCBleGVyY2lzZXMgdGhp
cwpjYXNlIGJ5IHNldHRpbmcgZGF0dGFibGVzcGFjZSB0byBhIG5vbi1leGlzdGVudCBPSUQgYW5k
IHZlcmlmeWluZyB0aGF0CnRoZSBmdW5jdGlvbiByZXR1cm5zIHN1Y2Nlc3NmdWxseSB3aXRob3V0
IGNyYXNoaW5nLgotLS0KIHNyYy9iYWNrZW5kL3V0aWxzL2FkdC9kZGx1dGlscy5jICAgICAgICAg
ICB8ICAyICstCiBzcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2RhdGFiYXNlX2RkbC5vdXQgfCAy
MiArKysrKysrKysrKysrKysrKysrKysrCiBzcmMvdGVzdC9yZWdyZXNzL3NxbC9kYXRhYmFzZV9k
ZGwuc3FsICAgICAgfCAxNyArKysrKysrKysrKysrKysrKwogMyBmaWxlcyBjaGFuZ2VkLCA0MCBp
bnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvdXRp
bHMvYWR0L2RkbHV0aWxzLmMgYi9zcmMvYmFja2VuZC91dGlscy9hZHQvZGRsdXRpbHMuYwppbmRl
eCBiMTZjMjc3ZDAwMC4uYzU4ODViMTg5NTggMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL3V0aWxz
L2FkdC9kZGx1dGlscy5jCisrKyBiL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC9kZGx1dGlscy5jCkBA
IC05NzYsNyArOTc2LDcgQEAgcGdfZ2V0X2RhdGFiYXNlX2RkbF9pbnRlcm5hbChPaWQgZGJpZCwg
Ym9vbCBwcmV0dHksCiAJewogCQljaGFyCSAgICpzcGNuYW1lID0gZ2V0X3RhYmxlc3BhY2VfbmFt
ZShkYmZvcm0tPmRhdHRhYmxlc3BhY2UpOwogCi0JCWlmIChwZ19zdHJjYXNlY21wKHNwY25hbWUs
ICJwZ19kZWZhdWx0IikgIT0gMCkKKwkJaWYgKHNwY25hbWUgIT0gTlVMTCAmJiBwZ19zdHJjYXNl
Y21wKHNwY25hbWUsICJwZ19kZWZhdWx0IikgIT0gMCkKIAkJCWFwcGVuZF9kZGxfb3B0aW9uKCZi
dWYsIHByZXR0eSwgNCwgIlRBQkxFU1BBQ0UgPSAlcyIsCiAJCQkJCQkJICBxdW90ZV9pZGVudGlm
aWVyKHNwY25hbWUpKTsKIAl9CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVk
L2RhdGFiYXNlX2RkbC5vdXQgYi9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2RhdGFiYXNlX2Rk
bC5vdXQKaW5kZXggOTc2NTdlNTJjZmEuLjAwZWMxYmRjMWY5IDEwMDY0NAotLS0gYS9zcmMvdGVz
dC9yZWdyZXNzL2V4cGVjdGVkL2RhdGFiYXNlX2RkbC5vdXQKKysrIGIvc3JjL3Rlc3QvcmVncmVz
cy9leHBlY3RlZC9kYXRhYmFzZV9kZGwub3V0CkBAIC04Myw2ICs4MywyOCBAQCBFUlJPUjogIHBl
cm1pc3Npb24gZGVuaWVkIGZvciBkYXRhYmFzZSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbAogUkVT
RVQgUk9MRTsKIEdSQU5UIENPTk5FQ1QgT04gREFUQUJBU0UgcmVncmVzc2lvbl9kYXRhYmFzZV9k
ZGwgVE8gUFVCTElDOwogRFJPUCBST0xFIHJlZ3Jlc3NfZGJfZGRsX25vYWNjZXNzOworLS0gVGVz
dCBmb3IgZHJvcHBlZCB0YWJsZXNwYWNlOiBkYXR0YWJsZXNwYWNlIHBvaW50aW5nIHRvIGEgbm9u
LWV4aXN0ZW50IE9JRAorLS0gc2hvdWxkIG5vdCBjcmFzaCAoc2VlIGNvbW1pdCBmaXhpbmcgTlVM
TCBkZXJlZiBpbiBwZ19nZXRfZGF0YWJhc2VfZGRsX2ludGVybmFsKQorQ1JFQVRFIERBVEFCQVNF
IHJlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsMgorICBFTkNPRElORyB1dGY4IExDX0NPTExBVEUgIkMi
IExDX0NUWVBFICJDIiBURU1QTEFURSB0ZW1wbGF0ZTAKKyAgT1dORVIgcmVncmVzc19kYXRkYmE7
CitTRVQgYWxsb3dfc3lzdGVtX3RhYmxlX21vZHMgPSBvbjsKK1VQREFURSBwZ19kYXRhYmFzZSBT
RVQgZGF0dGFibGVzcGFjZSA9IDk5OTk5CisgICAgV0hFUkUgZGF0bmFtZSA9ICdyZWdyZXNzaW9u
X2RhdGFiYXNlX2RkbDInOworUkVTRVQgYWxsb3dfc3lzdGVtX3RhYmxlX21vZHM7CitTRUxFQ1Qg
ZGRsX2ZpbHRlcihwZ19nZXRfZGF0YWJhc2VfZGRsKSBGUk9NIHBnX2dldF9kYXRhYmFzZV9kZGwo
J3JlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsMicpOworICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBkZGxfZmlsdGVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgCistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KKyBDUkVBVEUgREFUQUJBU0UgcmVn
cmVzc2lvbl9kYXRhYmFzZV9kZGwyIFdJVEggVEVNUExBVEUgPSB0ZW1wbGF0ZTAgRU5DT0RJTkcg
PSAnVVRGOCc7CisgQUxURVIgREFUQUJBU0UgcmVncmVzc2lvbl9kYXRhYmFzZV9kZGwyIE9XTkVS
IFRPIHJlZ3Jlc3NfZGF0ZGJhOworKDIgcm93cykKKworU0VUIGFsbG93X3N5c3RlbV90YWJsZV9t
b2RzID0gb247CitVUERBVEUgcGdfZGF0YWJhc2UgU0VUIGRhdHRhYmxlc3BhY2UgPQorICAoU0VM
RUNUIG9pZCBGUk9NIHBnX3RhYmxlc3BhY2UgV0hFUkUgc3BjbmFtZSA9ICdwZ19kZWZhdWx0JykK
KyAgICBXSEVSRSBkYXRuYW1lID0gJ3JlZ3Jlc3Npb25fZGF0YWJhc2VfZGRsMic7CitSRVNFVCBh
bGxvd19zeXN0ZW1fdGFibGVfbW9kczsKK0RST1AgREFUQUJBU0UgcmVncmVzc2lvbl9kYXRhYmFz
ZV9kZGwyOwogRFJPUCBEQVRBQkFTRSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDsKIERST1AgRlVO
Q1RJT04gZGRsX2ZpbHRlcih0ZXh0KTsKIERST1AgUk9MRSByZWdyZXNzX2RhdGRiYTsKZGlmZiAt
LWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL2RhdGFiYXNlX2RkbC5zcWwgYi9zcmMvdGVzdC9y
ZWdyZXNzL3NxbC9kYXRhYmFzZV9kZGwuc3FsCmluZGV4IDg5NzUzYWM2NDExLi4wNzkyYTRhOWYz
NSAxMDA2NDQKLS0tIGEvc3JjL3Rlc3QvcmVncmVzcy9zcWwvZGF0YWJhc2VfZGRsLnNxbAorKysg
Yi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9kYXRhYmFzZV9kZGwuc3FsCkBAIC02MSw2ICs2MSwyMyBA
QCBSRVNFVCBST0xFOwogR1JBTlQgQ09OTkVDVCBPTiBEQVRBQkFTRSByZWdyZXNzaW9uX2RhdGFi
YXNlX2RkbCBUTyBQVUJMSUM7CiBEUk9QIFJPTEUgcmVncmVzc19kYl9kZGxfbm9hY2Nlc3M7CiAK
Ky0tIFRlc3QgZm9yIGRyb3BwZWQgdGFibGVzcGFjZTogZGF0dGFibGVzcGFjZSBwb2ludGluZyB0
byBhIG5vbi1leGlzdGVudCBPSUQKKy0tIHNob3VsZCBub3QgY3Jhc2ggKHNlZSBjb21taXQgZml4
aW5nIE5VTEwgZGVyZWYgaW4gcGdfZ2V0X2RhdGFiYXNlX2RkbF9pbnRlcm5hbCkKK0NSRUFURSBE
QVRBQkFTRSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDIKKyAgRU5DT0RJTkcgdXRmOCBMQ19DT0xM
QVRFICJDIiBMQ19DVFlQRSAiQyIgVEVNUExBVEUgdGVtcGxhdGUwCisgIE9XTkVSIHJlZ3Jlc3Nf
ZGF0ZGJhOworU0VUIGFsbG93X3N5c3RlbV90YWJsZV9tb2RzID0gb247CitVUERBVEUgcGdfZGF0
YWJhc2UgU0VUIGRhdHRhYmxlc3BhY2UgPSA5OTk5OQorICAgIFdIRVJFIGRhdG5hbWUgPSAncmVn
cmVzc2lvbl9kYXRhYmFzZV9kZGwyJzsKK1JFU0VUIGFsbG93X3N5c3RlbV90YWJsZV9tb2RzOwor
U0VMRUNUIGRkbF9maWx0ZXIocGdfZ2V0X2RhdGFiYXNlX2RkbCkgRlJPTSBwZ19nZXRfZGF0YWJh
c2VfZGRsKCdyZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDInKTsKK1NFVCBhbGxvd19zeXN0ZW1fdGFi
bGVfbW9kcyA9IG9uOworVVBEQVRFIHBnX2RhdGFiYXNlIFNFVCBkYXR0YWJsZXNwYWNlID0KKyAg
KFNFTEVDVCBvaWQgRlJPTSBwZ190YWJsZXNwYWNlIFdIRVJFIHNwY25hbWUgPSAncGdfZGVmYXVs
dCcpCisgICAgV0hFUkUgZGF0bmFtZSA9ICdyZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDInOworUkVT
RVQgYWxsb3dfc3lzdGVtX3RhYmxlX21vZHM7CitEUk9QIERBVEFCQVNFIHJlZ3Jlc3Npb25fZGF0
YWJhc2VfZGRsMjsKKwogRFJPUCBEQVRBQkFTRSByZWdyZXNzaW9uX2RhdGFiYXNlX2RkbDsKIERS
T1AgRlVOQ1RJT04gZGRsX2ZpbHRlcih0ZXh0KTsKIERST1AgUk9MRSByZWdyZXNzX2RhdGRiYTsK
LS0gCjIuMzQuMQoK
--0000000000004a77a8064f1bbc10--