| From: | PG Bug reporting form <noreply(at)postgresql(dot)org> |
|---|---|
| To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Cc: | 1217816127(at)qq(dot)com |
| Subject: | BUG #19602: Vuln46: citext split_part silently returns NULL for a zero field position instead of raising core sp |
| Date: | 2026-08-03 06:58:12 |
| Message-ID: | 19602-5ec4b4e30fa6f5f2@postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
The following bug has been logged on the website:
Bug reference: 19602
Logged by: Yuelin Wang
Email address: 1217816127(at)qq(dot)com
PostgreSQL version: 19beta2
Operating system: Linux (Ubuntu 24.04, x86_64)
Description:
## Vuln46: citext split_part silently returns NULL for a zero field position
instead of raising core split_part's error
### Summary
citext.split_part(citext, citext, int) is implemented in SQL as an array
subscript expression (regexp_split_to_array(...))[$3] rather than by calling
pg_catalog.split_part. Postgres array subscripting silently returns NULL for
an out of range index such as 0, so citext's split_part diverges from core
split_part, which explicitly raises "field position must not be zero" for a
zero field argument.
CWE: CWE-1284. Severity: Low.
### PoC
```sql
CREATE EXTENSION citext;
SELECT split_part('abc~(at)~def~@~ghi'::citext, '~(at)~', 0) IS NULL AS is_null_0;
SELECT split_part('abc~(at)~def~@~ghi'::citext, '~(at)~', 0);
SELECT pg_catalog.split_part('abc~(at)~def~@~ghi', '~(at)~', 0);
```
### Result
Real captured output from the independent verification run:
```
CREATE EXTENSION
is_null_0
-----------
t
(1 row)
split_part
------------
(1 row)
ERROR: field position must not be zero
```
### Impact
An application that relies on split_part raising an error for a zero field
position to catch a programming or input validation bug will instead
silently receive NULL when operating on citext values, potentially masking
the underlying logic error rather than failing loudly.
| From | Date | Subject | |
|---|---|---|---|
| Next Message | PG Bug reporting form | 2026-08-03 07:00:47 | BUG #19603: Vuln47: distance_taxicab and distance_chebyshev silently return 0 instead of NaN when a cube coordin |
| Previous Message | PG Bug reporting form | 2026-08-03 06:54:06 | BUG #19601: Vuln45: Unbounded recursion via self-retying Perl scalar in bool_plperl's SvTRUE call causes backend |