From 73bb0a0e75bf589aae3c463d1d442552da364384 Mon Sep 17 00:00:00 2001 From: "Chao Li (Evan)" Date: Mon, 21 Sep 2026 11:26:23 +0800 Subject: [PATCH v2] psql: Avoid over-reading unterminated prompt escapes When parsing the %:name: and %`command` prompt escapes, get_prompt() assumed that the terminating delimiter was present. If it was absent, the parser positioned its pointer at the prompt string's NUL terminator. The loop increment then advanced the pointer one byte past the string, and the next loop condition dereferenced it. Only advance over the delimiter when it is present. Author: Chao Li Reviewed-by: Kirill Reshke Discussion: https://postgr.es/m/0B33F84F-6AA3-4A39-A45D-D8F31D4E44D8@gmail.com --- src/bin/psql/prompt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/bin/psql/prompt.c b/src/bin/psql/prompt.c index 681574bee79..1c79a829090 100644 --- a/src/bin/psql/prompt.c +++ b/src/bin/psql/prompt.c @@ -333,7 +333,9 @@ get_prompt(promptStatus_t prompt_status, ConditionalStack cstack) (void) pg_strip_crlf(buf); pfree(file); - p += cmdend + 1; + p += cmdend; + if (p[1] != '\0') + p++; break; } @@ -348,7 +350,9 @@ get_prompt(promptStatus_t prompt_status, ConditionalStack cstack) if (val) strlcpy(buf, val, sizeof(buf)); pfree(name); - p += nameend + 1; + p += nameend; + if (p[1] != '\0') + p++; break; } -- 2.50.1 (Apple Git-155)