Re: [PATCH] Fix two client-side NULL dereferences on malformed result sets (libpq, pg_receivewal)

From: Fujii Masao <masao(dot)fujii(at)gmail(dot)com>
To: Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com>
Cc: s1ko <s1ko(at)riseup(dot)net>, pgsql-hackers(at)lists(dot)postgresql(dot)org
Subject: Re: [PATCH] Fix two client-side NULL dereferences on malformed result sets (libpq, pg_receivewal)
Date: 2026-11-11 06:46:58
Message-ID: CAHGQGwEw8dvtHFh14BYXCbkHQPksjMy+Yv=c=L=KnnE61qKPHw@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Tue, Nov 10, 2026 at 5:57 PM Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com> wrote:
> So 0002 also looks good to me.

Both patches look good to me too.
We should backpatch them to all supported versions?

BTW, there seem similar missing column-count checks in BaseBackup()
in pg_basebackup.c:

- The backup start and end position results are checked for one row,
but not for at least one column, before passing column 0 to strlcpy().
- The tablespace header is checked for rows, but not for at least
three columns, before passing column 2 to atoll().

Malformed responses could therefore cause NULL dereferences here too.
We should fix these separately?

Regards,

--
Fujii Masao

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Andrey Borodin 2026-11-11 06:49:37 Re: Honor inherited ownership when finishing prepared transactions
Previous Message Andrey Borodin 2026-11-11 06:24:42 Re: Recovery does not honor io_combine_limit, causing IOPS saturation