Lack of Sanity Checking in file 'pctcl.c' for PostgreSQL 9.4.x

============================================================================
                        POSTGRESQL BUG REPORT TEMPLATE
============================================================================

Your name               : Bill Parker
Your email address      : wp02855 at gmail dot com

System Configuration:
---------------------
  Architecture (example: Intel Pentium)         :  x86/x86-64/AMD

  Operating System (example: Linux 2.4.18)      :  Linux 3.11.6-4

  PostgreSQL version (example: PostgreSQL 9.4.3):  PostgreSQL 9.4.x

  Compiler used (example: gcc 3.3.5)            :  gcc version 4.8.1

Please enter a FULL description of your problem:
------------------------------------------------

Hello All,

   In reviewing some code, in directory 'postgresql-9.4.3/src/pl/tcl',
file 'pltcl.c', there are several instances where calls to malloc()
are made, but no check for a return value of NULL is made, which
would indicate failure.   Additionally, it appears when malloc()
returns NULL, previously allocated memory in function 'perm_fmgr_info'
is not released, which could lead to memory leaks (even though the
comment at the top says 'this routine is a crock' :)

If you know how this problem might be fixed, list the solution below:
---------------------------------------------------------------------

The patch file below addresses these issues:

--- pltcl.c.orig        2015-06-11 08:41:24.316077095 -0700
+++ pltcl.c     2015-06-11 08:48:49.186617853 -0700
@@ -2136,11 +2136,28 @@
         * Allocate the new querydesc structure
         ************************************************************/
        qdesc = (pltcl_query_desc *) malloc(sizeof(pltcl_query_desc));
+       if (qdesc == NULL)
+           ereport(ERROR, ((errcode(ERRCODE_OUT_OF_MEMORY), errmsg("out of
memory")));
        snprintf(qdesc->qname, sizeof(qdesc->qname), "%p", qdesc);
        qdesc->nargs = nargs;
        qdesc->argtypes = (Oid *) malloc(nargs * sizeof(Oid));
+       if (qdesc->argtypes == NULL) {
+           free(qdesc);
+           ereport(ERROR, ((errcode(ERRCODE_OUT_OF_MEMORY), errmsg("out of
memory")));
+       }
        qdesc->arginfuncs = (FmgrInfo *) malloc(nargs * sizeof(FmgrInfo));
+       if (qdesc->arginfuncs == NULL) {
+           free(qdesc->argtypes);
+           free(qdesc);
+           ereport(ERROR, ((errcode(ERRCODE_OUT_OF_MEMORY), errmsg("out of
memory")));
+       }
        qdesc->argtypioparams = (Oid *) malloc(nargs * sizeof(Oid));
+       if (qdesc->argtypioparams == NULL) {
+           free(qdesc->inargfuncs);
+           free(qdesc->argtypes);
+           free(qdesc);
+       }
+           ereport(ERROR, ((errcode(ERRCODE_OUT_OF_MEMORY), errmsg("out of
memory")));

        /************************************************************
         * Execute the prepare inside a sub-transaction, so we can cope with

Please feel free to review and comment on the above patch file...

I am attaching the patch file to this bug report

Bill Parker (wp02855 at gmail dot com)