[PATCH] Fix NULL dereference in pg_get_database_ddl()

From: Ayush Tiwari <ayushtiwari(dot)slg01(at)gmail(dot)com>
To: pgsql-hackers(at)postgresql(dot)org
Subject: [PATCH] Fix NULL dereference in pg_get_database_ddl()
Date: 2026-04-10 13:57:58
Message-ID: CAJTYsWWzqpoRYxyA4ukjYpMPGEDgK2Za4t4wu9GdWOAtT8v-SQ@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

pg_get_database_ddl_internal() can dereference a NULL pointer when
pg_database.dattablespace points to a tablespace OID that no longer
exists.

The immediate issue is that get_tablespace_name() may return NULL, but
the result is passed directly to pg_strcasecmp():

spcname = get_tablespace_name(dbform->dattablespace);
if (pg_strcasecmp(spcname, "pg_default") != 0)
...

That leads to a backend crash. I reproduced it on current master as a
SIGSEGV with crash recovery.

This function was introduced by commit a4f774cf1c7.

Deterministic reproduction:

CREATE DATABASE regression_testdb;
SET allow_system_table_mods = on;
UPDATE pg_database
SET dattablespace = 99999
WHERE datname = 'regression_testdb';
RESET allow_system_table_mods;

SELECT * FROM pg_get_database_ddl('regression_testdb');

The attached patch fixes this by checking for NULL before calling
pg_strcasecmp(). In that case, pg_get_database_ddl() simply omits the
TABLESPACE clause.

I also added a regression test in database_ddl.sql that exercises this
case by setting dattablespace to a non-existent OID and verifying that
the function returns successfully.

Patch attached. Please review and let me know if it needs any edits. Thanks!

Regards,
Ayush Tiwari

Attachment Content-Type Size
0001-Fix-NULL-dereference-in-pg_get_database_ddl.patch application/octet-stream 4.7 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Fujii Masao 2026-04-10 14:01:41 Re: pgsql: Reduce log level of some logical decoding messages from LOG to D
Previous Message Bruce Momjian 2026-04-10 13:27:47 Re: Heads Up: cirrus-ci is shutting down June 1st