Horton
Menu

Re: BUG #18943: Return value of a function 'xmlBufferCreate' is dereferenced at xpath.c:177 without checking for NUL

Michael Paquier <michael@paquier.xyz>

View thread
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robin Haberkorn <haberkorn@b1-systems.de>, Jim Jones <jim.jones@uni-muenster.de>, pgsql-bugs@lists.postgresql.org, maralist86@mail.ru
Date: 2025-07-09T00:45:07Z
Lists: pgsql-bugs 
On Tue, Jul 08, 2025 at 09:36:37AM -0400, Tom Lane wrote:
> The comment in xml_errorHandler() argues

Yep.

> So switching to _ALL (or even _WELL_FORMED) mode would result in
> nontrivial differences in the behavior of xpath.c's functions with
> bad input.  Maybe that's a reasonable thing to do, but it's a
> question of user-visible behavior not just code cleanliness.

Yes, I don't see a huge advantage in doing the switch for this module.
If the gain in information in the error states grabbed from libxml2
makes it a win, that may be a different argument (I am fine to be
proved wrong), but I cannot get excited about that without more
data to claim it so.

I have quickly tested the change, and the xpath_string() path was one
area that immediately stood out, and we may report an incorrect error.
--
Michael

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. xml2: Fix failure with xslt_process() under -fsanitize=undefined

  2. Fix misuse of "volatile" in xml.c

  3. xml2: Improve error handling of libxml2 calls

  4. Improve error handling of libxml2 calls in xml.c