From 7275eaf4645e44cce13cc1cc2bcb7992b9bb8e7d Mon Sep 17 00:00:00 2001 From: Baji Shaik Date: Fri, 23 Oct 2026 15:37:59 -0500 Subject: [PATCH] Fix pg_dump of grouped large object ACLs granted by a non-owner When grants on large objects were made by a role other than the owner, the ACL commands include SET SESSION AUTHORIZATION and RESET SESSION AUTHORIZATION. IssueACLPerBlob() expected every command to name a large object, so for a group of large objects it failed an assertion, or in non-assert builds emitted broken commands like "SET SESSION AUTHORIZATION bob16385(null);" that fail on restore. Emit such commands once, as they are. Author: Baji Shaik Backpatch-through: 17 --- src/bin/pg_dump/pg_backup_db.c | 13 ++++++++++--- src/bin/pg_dump/t/002_pg_dump.pl | 31 +++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 3 deletions(-) diff --git a/src/bin/pg_dump/pg_backup_db.c b/src/bin/pg_dump/pg_backup_db.c index 17c0b7cbdf2..400e14987a1 100644 --- a/src/bin/pg_dump/pg_backup_db.c +++ b/src/bin/pg_dump/pg_backup_db.c @@ -606,9 +606,16 @@ IssueACLPerBlob(ArchiveHandle *AH, TocEntry *te) { /* Terminate the second-half string */ *en++ = '\0'; - Assert(st2 != NULL); - /* Issue this command for each blob */ - IssueCommandPerBlob(AH, blobte, st, st2); + if (st2 != NULL) + { + /* Issue this command for each blob */ + IssueCommandPerBlob(AH, blobte, st, st2); + } + else + { + /* Not blob-specific (e.g. SET SESSION AUTHORIZATION) */ + ahprintf(AH, "%s;\n\n", st); + } /* For neatness, skip whitespace before the next command */ while (isspace((unsigned char) *en)) en++; diff --git a/src/bin/pg_dump/t/002_pg_dump.pl b/src/bin/pg_dump/t/002_pg_dump.pl index c89d699e816..ef38a2a6c9a 100644 --- a/src/bin/pg_dump/t/002_pg_dump.pl +++ b/src/bin/pg_dump/t/002_pg_dump.pl @@ -4622,6 +4622,37 @@ my %tests = ( }, }, + 'GRANT SELECT ON LARGE OBJECT ... by non-owner' => { + create_order => 61, + create_sql => 'SELECT pg_catalog.lo_create(90001), pg_catalog.lo_create(90002); + GRANT SELECT ON LARGE OBJECT 90001, 90002 + TO regress_dump_test_role WITH GRANT OPTION; + SET ROLE regress_dump_test_role; + GRANT SELECT ON LARGE OBJECT 90001, 90002 TO PUBLIC; + RESET ROLE;', + regexp => qr/^ + \QSET SESSION AUTHORIZATION regress_dump_test_role;\E\n\n + \QGRANT SELECT ON LARGE OBJECT 90001 TO PUBLIC;\E\n + \QGRANT SELECT ON LARGE OBJECT 90002 TO PUBLIC;\E\n\n + \QRESET SESSION AUTHORIZATION;\E + /xm, + like => { + %full_runs, + column_inserts => 1, + data_only => 1, + inserts => 1, + no_schema => 1, + section_data => 1, + test_schema_plus_large_objects => 1, + }, + unlike => { + binary_upgrade => 1, + no_large_objects => 1, + no_privs => 1, + schema_only => 1, + }, + }, + 'GRANT INSERT(col1) ON TABLE test_second_table' => { create_order => 8, create_sql => -- 2.54.0 (Apple Git-157)