From 0383a310e9c77947502060c8755ff1382f7ada97 Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Wed, 12 Aug 2026 10:01:35 +0900 Subject: [PATCH v2 3/3] Fix psql slash option leaks psql_scan_slash_option() returns a malloc'd string, but \getresults, \gset in pipeline mode, \restrict, and \unrestrict did not free it after consuming or copying the value. Free these option strings after use. Backpatch to all supported versions. In v17 and older, only \restrict and \unrestrict are affected, so those branches need only that part of the fix. --- src/bin/psql/command.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c index b91fd85c977..7a3e88ea5c3 100644 --- a/src/bin/psql/command.c +++ b/src/bin/psql/command.c @@ -1944,6 +1944,7 @@ exec_command_getresults(PsqlScanState scan_state, bool active_branch) if (opt != NULL) { num_results = atoi(opt); + free(opt); if (num_results < 0) { pg_log_error("\\getresults: invalid number of requested results"); @@ -1999,6 +2000,7 @@ exec_command_gset(PsqlScanState scan_state, bool active_branch) { pg_log_error("\\%s not allowed in pipeline mode", "gset"); clean_extended_state(); + free(prefix); return PSQL_CMD_ERROR; } @@ -2800,10 +2802,12 @@ exec_command_restrict(PsqlScanState scan_state, bool active_branch, if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); + free(opt); return PSQL_CMD_ERROR; } restrict_key = pstrdup(opt); + free(opt); restricted = true; } else @@ -3208,22 +3212,26 @@ exec_command_unrestrict(PsqlScanState scan_state, bool active_branch, if (opt == NULL || opt[0] == '\0') { pg_log_error("\\%s: missing required argument", cmd); + free(opt); return PSQL_CMD_ERROR; } if (!restricted) { pg_log_error("\\%s: not currently in restricted mode", cmd); + free(opt); return PSQL_CMD_ERROR; } else if (strcmp(opt, restrict_key) == 0) { pfree(restrict_key); restricted = false; + free(opt); } else { pg_log_error("\\%s: wrong key", cmd); + free(opt); return PSQL_CMD_ERROR; } } -- 2.55.0