From c4144dc1a37ea933a2985b9340b79b9232122d8a Mon Sep 17 00:00:00 2001
From: Yuriy Grigoryev <ju.grigorev@ftdata.ru>
Date: Tue, 15 Sep 2026 09:34:36 +0700
Subject: [PATCH v2] Fix postmaster crash on whitespace-only
 oauth_validator_libraries

check_oauth_validator() checks the raw GUC string for an empty validator
list.  That does not cover a value containing only whitespace.
SplitDirectoriesString() accepts such input and returns an empty list, so
the code dereferences NIL when an OAuth HBA line has no validator option.
This can crash the postmaster while processing SIGHUP.

Check the parsed list instead and add a TAP test that reloads an invalid
whitespace-only setting and verifies that the server remains available.
---
 src/backend/libpq/auth-oauth.c                | 28 +++++++++----------
 .../modules/oauth_validator/t/001_server.pl   | 16 +++++++++++
 2 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c
index b769931ca4f..90d223eed00 100644
--- a/src/backend/libpq/auth-oauth.c
+++ b/src/backend/libpq/auth-oauth.c
@@ -863,19 +863,6 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 
 	*err_msg = NULL;
 
-	if (oauth_validator_libraries_string[0] == '\0')
-	{
-		ereport(elevel,
-				errcode(ERRCODE_CONFIG_FILE_ERROR),
-				errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
-					   "oauth_validator_libraries", "oauth"),
-				errcontext("line %d of configuration file \"%s\"",
-						   line_num, file_name));
-		*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
-							"oauth_validator_libraries", "oauth");
-		return false;
-	}
-
 	/* SplitDirectoriesString needs a modifiable copy */
 	rawstring = pstrdup(oauth_validator_libraries_string);
 
@@ -891,9 +878,22 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg)
 		goto done;
 	}
 
+	if (elemlist == NIL)
+	{
+		ereport(elevel,
+				errcode(ERRCODE_CONFIG_FILE_ERROR),
+				errmsg("parameter \"%s\" must be set for authentication method \"%s\"",
+					   "oauth_validator_libraries", "oauth"),
+				errcontext("line %d of configuration file \"%s\"",
+						   line_num, file_name));
+		*err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"",
+							"oauth_validator_libraries", "oauth");
+		goto done;
+	}
+
 	if (!hbaline->oauth_validator)
 	{
-		if (elemlist->length == 1)
+		if (list_length(elemlist) == 1)
 		{
 			hbaline->oauth_validator = pstrdup(linitial(elemlist));
 			goto done;
diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl
index 8941a355423..65f73cbdbb2 100644
--- a/src/test/modules/oauth_validator/t/001_server.pl
+++ b/src/test/modules/oauth_validator/t/001_server.pl
@@ -123,6 +123,22 @@ $node->reload;
 $log_start =
   $node->wait_for_log(qr/reloading configuration files/, $log_start);
 
+# An all-whitespace library list parses as an empty list.  Reject it without
+# crashing the postmaster during HBA reload.
+$node->append_conf('postgresql.conf',
+	"oauth_validator_libraries = '   '\n");
+$node->reload;
+$log_start = $node->wait_for_log(
+	qr/parameter "oauth_validator_libraries" must be set for authentication/,
+	$log_start);
+$bgconn->query_safe('SELECT 1');
+
+$node->append_conf('postgresql.conf',
+	"oauth_validator_libraries = 'validator'\n");
+$node->reload;
+$log_start = $node->wait_for_log(qr/reloading configuration files/,
+	$log_start);
+
 # Check pg_hba_file_rules() support.
 my $contents = $bgconn->query_safe(
 	qq(SELECT rule_number, auth_method, options
-- 
2.39.5 (Apple Git-154)