Re: BUG #19491: Segmentation fault triggered by IS NULL

Thanks all for fixing this issue and making pg better. Since this issue can reliably crash the PostgreSQL server, I would like to ask whether it should be treated as a security vulnerability and whether it is eligible for CVE assignment.

Original


From: Álvaro Herrera <alvherre(at)kurilemu(dot)de&gt;
Date: 2026-06-11 22:27
To: Srinath Reddy Sadipiralla <srinath2133(at)gmail(dot)com&gt;
Cc: Ayush Tiwari <ayushtiwari(dot)slg01(at)gmail(dot)com&gt;, 798604270 <798604270(at)qq(dot)com&gt;, pgsql-bugs <pgsql-bugs(at)lists(dot)postgresql(dot)org&gt;
Subject: Re: BUG #19491: Segmentation fault triggered by IS NULL

On&nbsp;2026-Jun-06,&nbsp;Srinath&nbsp;Reddy&nbsp;Sadipiralla&nbsp;wrote:

&gt;&nbsp;On&nbsp;Fri,&nbsp;Jun&nbsp;5,&nbsp;2026&nbsp;at&nbsp;9:41 PM&nbsp;Ayush&nbsp;Tiwari&nbsp;<ayushtiwari(dot)slg01(at)gmail(dot)com&gt;
&gt;&nbsp;wrote:

&gt;&nbsp;&gt;&nbsp;Thanks,&nbsp;that&nbsp;reads&nbsp;better.&nbsp;&nbsp;v2&nbsp;attached,&nbsp;raising&nbsp;ERRCODE_CANNOT_COERCE
&gt;&nbsp;&gt;&nbsp;right&nbsp;where&nbsp;the&nbsp;coercion&nbsp;fails:
&gt;&nbsp;&gt;
&gt;&nbsp;&gt;&nbsp;&nbsp;&nbsp;ERROR:&nbsp;&nbsp;cannot&nbsp;cast&nbsp;type&nbsp;sqljson_mystr&nbsp;to&nbsp;text
&gt;&nbsp;&gt;
&gt;&nbsp;&gt;&nbsp;which&nbsp;also&nbsp;covers&nbsp;the&nbsp;JSON()&nbsp;WITH&nbsp;UNIQUE&nbsp;KEYS&nbsp;path.
&gt;&nbsp;
&gt;&nbsp;Thanks&nbsp;for&nbsp;the&nbsp;updated&nbsp;patch,&nbsp;LGTM.

Thank&nbsp;you,&nbsp;I&nbsp;have&nbsp;pushed&nbsp;this&nbsp;to&nbsp;all&nbsp;branches&nbsp;since&nbsp;16.

I&nbsp;also&nbsp;added&nbsp;an&nbsp;Assert()&nbsp;to&nbsp;makeJsonIsPredicate()&nbsp;that&nbsp;'expr'&nbsp;is&nbsp;not
null.&nbsp;&nbsp;This&nbsp;wouldn't&nbsp;have&nbsp;caught&nbsp;this&nbsp;problem,&nbsp;mind,&nbsp;because&nbsp;what&nbsp;was
really&nbsp;missing&nbsp;is&nbsp;an&nbsp;example&nbsp;case&nbsp;where&nbsp;the&nbsp;problem&nbsp;appears.&nbsp;&nbsp;However,
it&nbsp;seems&nbsp;good&nbsp;manners&nbsp;to&nbsp;disallow&nbsp;that&nbsp;case&nbsp;explicitly&nbsp;rather&nbsp;than
have&nbsp;it&nbsp;return&nbsp;a&nbsp;Expr&nbsp;node&nbsp;with&nbsp;a&nbsp;embedded&nbsp;null&nbsp;pointer&nbsp;that's&nbsp;only
going&nbsp;to&nbsp;cause&nbsp;indirect&nbsp;problems.

BTW&nbsp;the&nbsp;subject&nbsp;of&nbsp;this&nbsp;thread&nbsp;is&nbsp;somehow&nbsp;comically&nbsp;bogus.&nbsp;&nbsp;The&nbsp;problem
is&nbsp;IS&nbsp;JSON&nbsp;causing&nbsp;a&nbsp;NULL&nbsp;pointer&nbsp;dereference,&nbsp;not&nbsp;IS&nbsp;NULL.

--&nbsp;
Álvaro&nbsp;Herrera&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Breisgau,&nbsp;Deutschland&nbsp;&nbsp;—&nbsp;&nbsp;https://www.EnterpriseDB.com/