From: Andrey Rachitskiy Date: Tue, 11 Aug 2026 11:11:30 +0500 Subject: [PATCH] Fix SEGV in ParseConfigFp after a flex fatal error ParseConfigFp() longjmps out of fatal flex errors, then cleans up with yy_delete_buffer()/yylex_destroy(). After the reentrant scanner conversion, the yyscan_t local is written after sigsetjmp and read after siglongjmp without being volatile. That leaves a clobbered scanner pointer and can SEGV in cleanup (seen with AddressSanitizer when "include" points at a directory). Bug: #19612 Reported-by: Ilia Kashintsev Author: Andrey Rachitskiy --- src/backend/utils/misc/guc-file.l | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/backend/utils/misc/guc-file.l b/src/backend/utils/misc/guc-file.l index 58669a67e05..a8530a1e2c7 100644 --- a/src/backend/utils/misc/guc-file.l +++ b/src/backend/utils/misc/guc-file.l @@ -354,9 +354,9 @@ ParseConfigFp(FILE *fp, const char *config_file, int depth, int elevel, unsigned int save_ConfigFileLineno = ConfigFileLineno; sigjmp_buf *save_GUC_flex_fatal_jmp = GUC_flex_fatal_jmp; sigjmp_buf flex_fatal_jmp; - yyscan_t scanner; + volatile yyscan_t scanner = NULL; /* must survive siglongjmp */ struct yyguts_t *yyg; /* needed for yytext macro */ - volatile YY_BUFFER_STATE lex_buffer = NULL; + volatile YY_BUFFER_STATE lex_buffer = NULL; /* must survive siglongjmp */ int errorcount; int token; -- 2.43.0