Re: [Bug] Heap use-after-free in COPY FROM error context after ON_ERROR ignore skips a row

On Tue, Nov 03, 2026 at 12:20:33PM +0530, Gowdham M wrote:
> Yes, set_null hits the same stale pointer, and the patch fixes it, since the
> fields are cleared before each new line is read. Your test passes with the
> patch on REL_19_STABLE and master, and fails without it, so it can go on top
> of the patch for 19 and master.

Confirmed issue here as well. The test for SET_NULL is a good idea,
as you say down to v19 where this flavor has been added.

@@ -873,6 +873,14 @@ NextCopyFromRawFieldsInternal(CopyFromState cstate, char ***fields, int *nfields
return false;
}

+ /*
+ * Clear the current attribute for error messages. A row skipped by
+ * ON_ERROR leaves it set, with cur_attval pointing into attribute_buf,
+ * which is about to be reset and possibly enlarged.
+ */
+ cstate->cur_attname = NULL;
+ cstate->cur_attval = NULL;
+
cstate->cur_lineno++;

Resetting these two at this location seems a bit weird to me? What do
you think about the beginning of NextCopyFrom() instead? That's also
where the fields for the row to NULL are reset. I don't think that
this should be an issue for the COPY API portability or file_fdw.
--
Michael