Fix pfree crash in pg_get_role_ddl() and pg_get_database_ddl().

Andrew Dunstan <andrew@dunslane.net>

Commit: 1f108fc02ece09da5773ece74e25812cb952ebfc
Author: Andrew Dunstan <andrew@dunslane.net>
Date: 2026-04-14T22:29:46Z
Fix pfree crash in pg_get_role_ddl() and pg_get_database_ddl().

DatumGetArrayTypeP() can return a pointer into the tuple when the
datum is stored as a short varlena, so pfree() on the result crashes.
Use DatumGetArrayTypePCopy() to always get a palloc'd copy.

Bug introduced in 76e514ebb4b and a4f774cf1c7.

Reported-by: Jeff Davis <pgsql@j-davis.com>
Author: Satya Narlapuram <satya.narlapuram@gmail.com>
Discussion: https://postgr.es/m/CAHg+QDdWtv9PKtPZEokwGCNtbv4MVnfYw5wMZrsEj4xizSNe5Q@mail.gmail.com

Files

PathChange+/−
src/backend/utils/adt/ddlutils.c modified +2 −2

Discussion