Horton
Menu

Thread

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. plperl: Fix NULL pointer dereference for forged array object

  1. [PATCH v1] PL/Perl: Fix NULL deref for forged array

    Xing Guo <higuoxing@gmail.com> — 2026-06-23T06:46:44Z

    Hi hackers,

A PL/Perl function returning a forged PostgreSQL::InServer::ARRAY
object (e.g., an empty hash blessed as that class) could cause a
segfault. This occurs because hv_fetch_string returns NULL pointer
when the "array" key is missing, and the code previously dereferenced
it without checking if the pointer itself was NULL.

The attachment is the patch for fixing it.

Best Regards,
Xing

  2. Re: [PATCH v1] PL/Perl: Fix NULL deref for forged array

    Richard Guo <guofenglinux@gmail.com> — 2026-06-23T07:14:40Z

    On Tue, Jun 23, 2026 at 3:47 PM Xing Guo <higuoxing@gmail.com> wrote:
> A PL/Perl function returning a forged PostgreSQL::InServer::ARRAY
> object (e.g., an empty hash blessed as that class) could cause a
> segfault. This occurs because hv_fetch_string returns NULL pointer
> when the "array" key is missing, and the code previously dereferenced
> it without checking if the pointer itself was NULL.

+1.  Good catch.  Every other caller of hv_fetch_string checks the
returned pointer.  This is the only place missing that safety check.

- Richard

  3. Re: [PATCH v1] PL/Perl: Fix NULL deref for forged array

    Richard Guo <guofenglinux@gmail.com> — 2026-06-24T00:37:24Z

    On Tue, Jun 23, 2026 at 4:14 PM Richard Guo <guofenglinux@gmail.com> wrote:
> +1.  Good catch.  Every other caller of hv_fetch_string checks the
> returned pointer.  This is the only place missing that safety check.

I've committed and back-patched this patch after some cosmetic tweaks.

- Richard