From 92ebeae3794816beb0067afe3c4222815fe498c0 Mon Sep 17 00:00:00 2001 From: "Chao Li (Evan)" Date: Mon, 21 Sep 2026 11:26:23 +0800 Subject: [PATCH v1] psql: Avoid over-reading unterminated prompt escapes When parsing the %:name: and %`command` prompt escapes, get_prompt() assumed that the terminating delimiter was present. If it was absent, the parser positioned its pointer at the prompt string's NUL terminator. The loop increment then advanced the pointer one byte past the string, and the next loop condition dereferenced it. Only advance over the delimiter when it is present. Author: Chao Li --- src/bin/psql/prompt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/bin/psql/prompt.c b/src/bin/psql/prompt.c index 681574bee79..c34e1c9f667 100644 --- a/src/bin/psql/prompt.c +++ b/src/bin/psql/prompt.c @@ -333,7 +333,9 @@ get_prompt(promptStatus_t prompt_status, ConditionalStack cstack) (void) pg_strip_crlf(buf); pfree(file); - p += cmdend + 1; + p += cmdend; + if (p[1] == '`') + p++; break; } @@ -348,7 +350,9 @@ get_prompt(promptStatus_t prompt_status, ConditionalStack cstack) if (val) strlcpy(buf, val, sizeof(buf)); pfree(name); - p += nameend + 1; + p += nameend; + if (p[1] == ':') + p++; break; } -- 2.50.1 (Apple Git-155)