Re: BUG #19547: libpqrcv_create_slot dereferences NULL on a malformed CREATE_REPLICATION_SLOT reply

Hi,

Thanks for the detailed report and analysis. Here is a patch.

libpqrcv_create_slot() only checked PGRES_TUPLES_OK before reading the
consistent-point LSN and snapshot name from the first row, so a reply with
zero rows made PQgetvalue(res, 0, 1) return NULL, which pg_lsn_in() then
dereferenced -> crash in the tablesync worker.

The patch validates the result shape (>= 3 fields, exactly 1 row) before
reading those fields and raises a protocol-violation error otherwise,
mirroring what libpqrcv_identify_system() and the other result-consuming
paths in this file already do. I used "< 3" rather than "< 4" because the
function only reads fields 1 and 2.

Builds cleanly and "meson test --suite subscription" passes. I could not
find a good way to add a regression test, since it needs a rogue server
that returns a malformed reply; suggestions welcome.

Regards,
Kenny