From a8eb5a82e464ff33fffc8b437097b5ef50d70d3f Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Wed, 12 Aug 2026 10:01:35 +0900 Subject: [PATCH v1] Fix psql slash option leaks psql_scan_slash_option() returns a malloc'd string, but \getresults, \gset in pipeline mode, \restrict, and \unrestrict did not free it after consuming or copying the value. Free these option strings after use. Backpatch to all supported versions. In v17 and older, only \restrict and \unrestrict are affected, so those branches need only that part of the fix. --- src/bin/psql/command.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c index 190c5c6f77a..0ce97190015 100644 --- a/src/bin/psql/command.c +++ b/src/bin/psql/command.c @@ -1942,6 +1942,7 @@ exec_command_getresults(PsqlScanState scan_state, bool active_branch) if (opt != NULL) { num_results = atoi(opt); + free(opt); if (num_results < 0) { pg_log_error("\\getresults: invalid number of requested results"); @@ -1997,6 +1998,7 @@ exec_command_gset(PsqlScanState scan_state, bool active_branch) { pg_log_error("\\%s not allowed in pipeline mode", "gset"); clean_extended_state(); + free(prefix); return PSQL_CMD_ERROR; } @@ -2798,10 +2800,12 @@ exec_command_restrict(PsqlScanState scan_state, bool active_branch, if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); + free(opt); return PSQL_CMD_ERROR; } restrict_key = pstrdup(opt); + free(opt); restricted = true; } else @@ -3206,22 +3210,26 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); + free(opt); return PSQL_CMD_ERROR; } if (!restricted) { pg_log_error("\\%s: not currently in restricted mode", cmd); + free(opt); return PSQL_CMD_ERROR; } else if (strcmp(opt, restrict_key) == 0) { pfree(restrict_key); restricted = false; + free(opt); } else { pg_log_error("\\%s: wrong key", cmd); + free(opt); return PSQL_CMD_ERROR; } } -- 2.55.0