[PATCH v1] PL/Perl: Fix NULL deref for forged array
Hi hackers,
A PL/Perl function returning a forged PostgreSQL::InServer::ARRAY
object (e.g., an empty hash blessed as that class) could cause a
segfault. This occurs because hv_fetch_string returns NULL pointer
when the "array" key is missing, and the code previously dereferenced
it without checking if the pointer itself was NULL.
The attachment is the patch for fixing it.
Best Regards,
Xing
Attachments:
v1-0001-PL-Perl-Fix-NULL-deref-for-forged-array.patchapplication/octet-stream; name=v1-0001-PL-Perl-Fix-NULL-deref-for-forged-array.patchDownload+19-2
On Tue, Jun 23, 2026 at 3:47 PM Xing Guo <higuoxing@gmail.com> wrote:
A PL/Perl function returning a forged PostgreSQL::InServer::ARRAY
object (e.g., an empty hash blessed as that class) could cause a
segfault. This occurs because hv_fetch_string returns NULL pointer
when the "array" key is missing, and the code previously dereferenced
it without checking if the pointer itself was NULL.
+1. Good catch. Every other caller of hv_fetch_string checks the
returned pointer. This is the only place missing that safety check.
- Richard
On Tue, Jun 23, 2026 at 4:14 PM Richard Guo <guofenglinux@gmail.com> wrote:
+1. Good catch. Every other caller of hv_fetch_string checks the
returned pointer. This is the only place missing that safety check.
I've committed and back-patched this patch after some cosmetic tweaks.
- Richard