BUG #15624: Sefgault when xml_errorHandler receives a null error->message from libxml2

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: skgsergio(at)gmail(dot)com
Subject: BUG #15624: Sefgault when xml_errorHandler receives a null error->message from libxml2
Date: 2019-02-08 11:29:32
Message-ID: 15624-4dea54091a2864e6@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 15624
Logged by: Sergio Conde Gómez
Email address: skgsergio(at)gmail(dot)com
PostgreSQL version: 10.6
Operating system: Ubuntu Linux 16.04.5 LTS (Xenial Xerus)
Description:

Hello,

We've got a segfault when xml_errorHandler called appendStringInfoString
with null error->message, this ends calling strlen(NULL).

This is the struct received by xml_errorHandler was the following:
(gdb) print *error
$1 = {domain = 12, code = 2, message = 0x0, level = XML_ERR_FATAL, file =
0x0, line = 0, str1 = 0x5643cf615fe0 "creating context\n", str2 = 0x0, str3
= 0x0, int1 = 0, int2 = 0, ctxt = 0x0, node = 0x0}

According to libxml2 (we are using v2.9.2) domain 12 is XML_FROM_XPATH and
code 2 is XML_ERR_NO_MEMORY so postgre's xml_errorHandler it will try to
append the message.

Although libxml2 tries not to return a null message but both their xmlStrdup
function and XML_GET_VAR_STR can return null in a OOM scenario.

This also affects PostgreSQL 11 branch so here it is the proposed patch both
for REL_10_STABLE and REL_11_STABLE:

---
src/backend/utils/adt/xml.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
index 37d85f71f3..3b36544987 100644
--- a/src/backend/utils/adt/xml.c
+++ b/src/backend/utils/adt/xml.c
@@ -1696,7 +1696,8 @@ xml_errorHandler(void *data, xmlErrorPtr error)
appendStringInfo(errorBuf, "line %d: ", error->line);
if (name != NULL)
appendStringInfo(errorBuf, "element %s: ", name);
- appendStringInfoString(errorBuf, error->message);
+ if (error->message != NULL)
+ appendStringInfoString(errorBuf, error->message);

/*
* Append context information to errorBuf.
--
2.20.1

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tom Lane 2019-02-08 17:53:48 Re: BUG #15624: Sefgault when xml_errorHandler receives a null error->message from libxml2
Previous Message Dean Rasheed 2019-02-08 11:00:47 Re: BUG #15623: Inconsistent use of default for updatable view