pgsql: Fix pgoutput crash on missing option values

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix pgoutput crash on missing option values
Date: 2026-11-01 23:14:19
Message-ID: E1xNekl-00000001iVx-43bC@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix pgoutput crash on missing option values

The replication protocol allows options without values, but pgoutput
dereferenced a NULL DefElem argument for parameters proto_version and
publication_names. A replication client was able to crash a WAL sender.

This issue is fixed by reading both options with defGetString(), which
is able to report a missing parameter cleanly.

Reported-by: Brar Piening <brar(at)gmx(dot)de>
Author: Zhijie Hou <houzhijie22(at)gmail(dot)com>
Reviewed-by: Hayato Kuroda <kuroda(dot)hayato(at)fujitsu(dot)com>
Reviewed-by: Kirill Reshke <reshkekirill(at)gmail(dot)com>
Discussion: https://postgr.es/m/19795-6d7d506133b7f062@postgresql.org
Backpatch-through: 14

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/c3ef3f2283d6a9b8d63ba35c5bc5ad4f1864682d

Modified Files
--------------
src/backend/replication/pgoutput/pgoutput.c | 10 ++++----
src/bin/pg_basebackup/t/030_pg_recvlogical.pl | 35 +++++++++++++++++++++++++++
2 files changed, 40 insertions(+), 5 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Richard Guo 2026-11-02 01:33:58 pgsql: Fix wrong results from Memoize with a Param inside a cache key
Previous Message Tom Lane 2026-11-01 22:28:32 pgsql: Move plpython's rejection of pseudotype arguments/results.