From 6da0068f282531376ff798cc903cf211b02d0a03 Mon Sep 17 00:00:00 2001 From: Ilya Gladyshev Date: Tue, 18 Aug 2026 13:32:52 +0300 Subject: [PATCH] ecpg: fix missing NULL check in ecpg_store_input ecpg_store_input() called strlen() directly on the result of PGTYPESnumeric_to_asc() without checking for NULL. That function returns NULL on out-of-memory, so an OOM while binding a numeric/decimal host variable would crash the client with a null pointer dereference. --- src/interfaces/ecpg/ecpglib/execute.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/interfaces/ecpg/ecpglib/execute.c b/src/interfaces/ecpg/ecpglib/execute.c index 02380dafd9d..774ef463ab1 100644 --- a/src/interfaces/ecpg/ecpglib/execute.c +++ b/src/interfaces/ecpg/ecpglib/execute.c @@ -895,8 +895,13 @@ ecpg_store_input(const int lineno, const bool force_indicator, const struct vari } str = PGTYPESnumeric_to_asc(nval, nval->dscale); - slen = strlen(str); PGTYPESnumeric_free(nval); + if (!str) + { + ecpg_free(mallocedval); + return false; + } + slen = strlen(str); if (!(newcopy = ecpg_realloc(mallocedval, strlen(mallocedval) + slen + 2, lineno))) { -- 2.55.0