COPY FROM ON_ERROR SET_NULL bypasses domain NOT NULL with partial column list
SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>
From: SATYANARAYANA NARLAPURAM <satyanarlapuram@gmail.com>
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: jian he <jian.universality@gmail.com>
Date: 2026-04-16T17:09:40Z
Lists: pgsql-hackers
Attachments
- 0001-Fix-COPY-FROM-ON_ERROR-SET_NULL-OOB-read-with-partia.patch (application/octet-stream) patch 0001
HI hackers,
domain_with_constraint[] was allocated with list_length(attnumlist)
elements and indexed sequentially via foreach_current_index(), but
copyfromparse.c accesses it via attnum - 1 (physical attribute index).
With a partial column list targeting high-numbered columns, this caused
an out-of-bounds read that bypassed domain NOT NULL checks, silently
inserting NULL into NOT NULL domain columns.
Fix by allocating with num_phys_attrs and indexing by attnum - 1,
consistent with all other per-column arrays in BeginCopyFrom().
Patch is attached, and added a new test case to cover this scenario.
Repro:
CREATE DOMAIN d_notnull_int AS int NOT NULL;
CREATE TABLE t (
c1 text, c2 text, c3 text, c4 text, c5 text,
c6 text, c7 text, c8 text, c9 text,
c10 d_notnull_int
);
COPY t(c1, c10) FROM stdin WITH (on_error set_null);
hello bad
\.
SELECT c10 IS NULL FROM t;
Thanks,
Satya
Commits
Same data as JSON:
GET /api/v1/messages/:b64id/commits
the thread's linked commits as JSON, with link sources.
API reference →
-
Fix COPY FROM ON_ERROR SET_NULL with selective column list
- 1164a822729a 19 (unreleased) landed