upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-03-08 00:01:15 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

hstore: Fix NULL pointer dereference with receive function

Browse source 
The receive function of hstore was not able to handle correctly
duplicate key values when a new duplicate links to a NULL value, where a
pfree() could be attempted on a NULL pointer, crashing due to a pointer
dereference.

This problem would happen for a COPY BINARY, when stacking values like
that:
aa => 5
aa => null

The second key/value pair is discarded and pfree() calls are attempted
on its key and its value, leading to a pointer dereference for the value
part as the value is NULL.  The first key/value pair takes priority when
a duplicate is found.

Per offline report.

Reported-by: "Anemone" <vergissmeinnichtzh@gmail.com>
Reported-by: "A1ex" <alex000young@gmail.com>
Backpatch-through: 14
This commit is contained in:
Michael Paquier 2026-02-17 08:41:37 +09:00
parent 547a8aaa7d
commit f604cc695c
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
contrib/hstore/hstore_io.c
View file

@ -346,7 +346,8 @@ hstoreUniquePairs(Pairs *a, int32 l, int32 *buflen)
if (ptr->needfree)
{
pfree(ptr->key);
pfree(ptr->val);
if (ptr->val != NULL)
pfree(ptr->val);
}
}
else