upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-07-08 09:10:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

plperl: Fix NULL pointer dereference for forged array object

Browse source 
In get_perl_array_ref(), for a PostgreSQL::InServer::ARRAY object, we
look up its "array" key with hv_fetch_string() and then inspect the
returned SV.  However, hv_fetch_string() returns a NULL pointer when
the key is absent, and the code dereferenced that result without first
checking whether the pointer itself was NULL.  As a result, a plperl
function returning a forged PostgreSQL::InServer::ARRAY object that
lacks the "array" key would crash the backend with a segmentation
fault.

Fix this by checking the pointer returned by hv_fetch_string() before
dereferencing it, matching how other callers in this file already
guard the result.  With the check in place, such an object falls
through to the existing error report instead of crashing.

Author: Xing Guo <higuoxing@gmail.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/CACpMh+DYgcnqZwQLXXuxQcehJTd7T8UmKWSLsK4mFBEp9G2ajA@mail.gmail.com
Backpatch-through: 14
This commit is contained in:
Richard Guo 2026-06-24 09:09:48 +09:00
parent e8fbe5d838
commit e520ad34b4
3 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/pl/plperl/expected/plperl_array.out
View file

@ -274,3 +274,10 @@ select perl_setof_array('{{1}, {2}, {3}}');
{3}
(3 rows)
-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
return bless {}, "PostgreSQL::InServer::ARRAY";
$$ LANGUAGE plperl;
SELECT perl_forged_array();
ERROR: could not get array reference from PostgreSQL::InServer::ARRAY object
CONTEXT: PL/Perl function "perl_forged_array"

2
src/pl/plperl/plperl.c
View file

@ -1151,7 +1151,7 @@ get_perl_array_ref(SV *sv)
HV *hv = (HV *) SvRV(sv);
SV **sav = hv_fetch_string(hv, "array");
if (*sav && SvOK(*sav) && SvROK(*sav) &&
if (sav && *sav && SvOK(*sav) && SvROK(*sav) &&
SvTYPE(SvRV(*sav)) == SVt_PVAV)
return *sav;

7
src/pl/plperl/sql/plperl_array.sql
View file

@ -206,3 +206,10 @@ create or replace function perl_setof_array(integer[]) returns setof integer[] l
$$;
select perl_setof_array('{{1}, {2}, {3}}');
-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
return bless {}, "PostgreSQL::InServer::ARRAY";
$$ LANGUAGE plperl;
SELECT perl_forged_array();