Re: BUG #18943: Return value of a function 'xmlBufferCreate' isdereferenced at xpath.c:177 without checking for NUL

Alexander Lakhin <exclusion@gmail.com>

From: Alexander Lakhin <exclusion@gmail.com>

To: Michael Paquier <michael@paquier.xyz>, cca5507 <cca5507@qq.com>

Cc: Jim Jones <jim.jones@uni-muenster.de>, Tom Lane <tgl@sss.pgh.pa.us>, pgsql-bugs <pgsql-bugs@lists.postgresql.org>, maralist86 <maralist86@mail.ru>

Date: 2026-03-12T05:00:00Z

Lists: pgsql-bugs

Hello Michael,

Maybe you would like to fix in passing one more anomaly there:
create extension xml2;
select xslt_process('<aaa/>','<xsl:stylesheet version="1.0" 
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"></xsl:stylesheet>');

leads to:
varlena.c:199:2: runtime error: null pointer passed as argument 2, which is declared to never be null
     #0 0x640756666936 in cstring_to_text_with_len .../src/backend/utils/adt/varlena.c:199
     #1 0x7e46c0f4805e in xslt_process .../contrib/xml2/xslt_proc.c:149
     #2 0x640755a3ecbf in ExecInterpExpr .../src/backend/executor/execExprInterp.c:1001
     #3 0x640755a277aa in ExecInterpExprStillValid .../src/backend/executor/execExprInterp.c:2299
     #4 0x640755ef11e0 in ExecEvalExprSwitchContext ../../../../src/include/executor/executor.h:444
     #5 0x640755efd7b6 in evaluate_expr .../src/backend/optimizer/util/clauses.c:5724

for a build made with -fsanitize=undefined.

Best regards,
Alexander

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

xml2: Fix failure with xslt_process() under -fsanitize=undefined
- 70f7c5badcc0 14.23 landed
- 0b0041b942f7 15.18 landed
- 5f46c617e95f 16.14 landed
- 63aa4342da23 17.10 landed
- e33a4fda0027 18.4 landed
- 7d64419f8073 19 (unreleased) landed
Fix misuse of "volatile" in xml.c
- 6307b096e259 19 (unreleased) landed
xml2: Improve error handling of libxml2 calls
- 732061150b00 19 (unreleased) landed
Improve error handling of libxml2 calls in xml.c
- 2e947217474c 19 (unreleased) landed