Thread

1. BUG #18908: DEREF_OF_NULL: After having been assigned to a NULL value at descriptor.c:203

   PG Bug reporting form <noreply@postgresql.org> — 2025-04-30T11:25:56Z

   The following bug has been logged on the website:
   
   Bug reference:      18908
   Logged by:          Eugeny Goryachev
   Email address:      gorcom2012@gmail.com
   PostgreSQL version: 17.4
   Operating system:   Ubuntu
   Description:        
   
   DEREF_OF_NULL.EX.COND After having been assigned to a NULL value at
   descriptor.c:203, pointer '0' is passed as 5th parameter in call to function
   'ECPGdump_a_type' at descriptor.c:203, where it is dereferenced at
   type.c:332.
   In the file /src/interfaces/ecpg/preproc/descriptor.c, in the function
   output_get_descr(), there is a call to ECPGdump_a_type() with an explicit
   NULL passed as the 5th parameter:
   void
   output_get_descr(char *desc_name, char *index)
   {
   ***
       ECPGdump_a_type(base_yyout, v->name, v->type, v->brace_level,
                       NULL, NULL, -1, NULL, NULL, str_zero, NULL, NULL);
   ***
   }
   This NULL parameter is then passed to the ECPGdump_a_struct() function,
   where it gets dereferenced:
   static void
   ECPGdump_a_struct(FILE *o, const char *name, const char *ind_name, char
   *arrsize, struct ECPGtype *type, struct ECPGtype *ind_type, const char
   *prefix, const char *ind_prefix)
   {
   ***
       char *pbuf = (char *) mm_alloc(strlen(name) + ((prefix == NULL) ? 0 :
   strlen(prefix)) + 3);
   ***
   }
   When name == NULL, the strlen(name) call will cause a Segmentation Fault.
   To fix this issue, I propose the following patch:
   diff --git a/src/interfaces/ecpg/preproc/type.c
   b/src/interfaces/ecpg/preproc/type.c
   index a842bb6a1fe..7ffae74bcf2 100644
   --- a/src/interfaces/ecpg/preproc/type.c
   +++ b/src/interfaces/ecpg/preproc/type.c
   @@ -587,7 +587,7 @@ ECPGdump_a_struct(FILE *o, const char *name, const char
   *ind_name, char *arrsize
        struct ECPGstruct_member *p,
                   *ind_p = NULL;
        char       *pbuf = (char *) mm_alloc(strlen(name) + ((prefix == NULL) ?
   0 : strlen(prefix)) + 3);
   -    char       *ind_pbuf = (char *) mm_alloc(strlen(ind_name) +
   ((ind_prefix == NULL) ? 0 : strlen(ind_prefix)) + 3);
   +    char       *ind_pbuf = (char *) mm_alloc(((ind_name == NULL) ? 0 :
   strlen(ind_name)) + ((ind_prefix == NULL) ? 0 : strlen(ind_prefix)) + 3);
        if (atoi(arrsize) == 1)
            sprintf(pbuf, "%s%s.", prefix ? prefix : "", name);
   
   

2. Re: BUG #18908: DEREF_OF_NULL: After having been assigned to a NULL value at descriptor.c:203

   Robin Haberkorn <haberkorn@b1-systems.de> — 2025-05-08T12:55:41Z

   Hello Eugeny!
   
   On Wed Apr 30, 2025 at 14:25:56 GMT +03, PG Bug reporting form wrote:
   > DEREF_OF_NULL.EX.COND After having been assigned to a NULL value at
   > descriptor.c:203, pointer '0' is passed as 5th parameter in call to function
   > 'ECPGdump_a_type' at descriptor.c:203, where it is dereferenced at
   > type.c:332.
   
   Perhaps you can provide a pgc file that triggers the bug?
   
   Best regards,
   Robin
   
   -- 
   Robin Haberkorn
   Senior Software Engineer
   
   B1 Systems GmbH
   Osterfeldstraße 7 / 85088 Vohburg / https://www.b1-systems.de
   GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt, HRB 3537