Re: BUG #18943: Return value of a function 'xmlBufferCreate' is dereferenced at xpath.c:177 without checking for NUL

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: Jim Jones <jim(dot)jones(at)uni-muenster(dot)de>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, pgsql-bugs(at)lists(dot)postgresql(dot)org, maralist86(at)mail(dot)ru
Subject: Re: BUG #18943: Return value of a function 'xmlBufferCreate' is dereferenced at xpath.c:177 without checking for NUL
Date: 2025-06-08 02:19:29
Message-ID: aETzMep2fGfB0AIp@paquier.xyz
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On Fri, Jun 06, 2025 at 12:22:30PM +0200, Jim Jones wrote:
> So, perhaps this?
>
> if (xmlAddChildList(root, content_nodes) == NULL ||
> xmlerrcxt->err_occurred)
> xml_ereport(xmlerrcxt,
> ERROR, ERRCODE_OUT_OF_MEMORY,
> "could not add content nodes to root element");

ERRCODE_INTERNAL_ERROR would be more adapted, I'm only seeing error
code paths caused by inconsistencies in the nodes.

I have updated the patches with the attached, splitting the parts for
contrib/xml2/ and the backend into two parts. These touch error paths
that are very unlikely going to be hit in practice, so let's do all
that once v19 opens for business only on HEAD.
--
Michael

Attachment Content-Type Size
v4-0001-Improve-error-handling-with-calls-to-libxml2.patch text/x-diff 4.4 KB
v4-0002-xml2-Improve-error-handling-in-corner-cases.patch text/x-diff 19.0 KB

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Michael Paquier 2025-06-08 02:39:44 Re: BUG #18947: TRAP: failed Assert("len_to_wrt >= 0") in pg_stat_statements
Previous Message Tom Lane 2025-06-08 02:07:59 Re: BUG #18950: pgsql function that worked in Postgresql 16 does not return in Postgresql 17