SAY-5 opened a new pull request, #2401:
URL: https://github.com/apache/age/pull/2401
Fixes #2386.
`age_substring()` reads the null map produced by `extract_variadic_args()`
and rejects null offset/length with this guard:
```c
if ((nargs == 2 && nulls[1]) ||
(nargs == 3 && nulls[2]))
{
ereport(ERROR, ..., errmsg("substring() offset or length cannot be
null"));
}
```
The condition only checks `nulls[1]` in the 2-argument form. When the caller
passes `substring(str, null, len)` the function takes `nargs = 3`, `nulls[1] =
true`, but the guard above does not fire. Execution reaches the
numeric-parameter loop below, which reads `args[1]` through `DatumGetInt32` /
`DATUM_GET_AGTYPE_P` without ever re-checking `nulls[i]`. The Datum in that
slot is undefined, the dereference segfaults, and the PostgreSQL backend
terminates — not a query error but a connection-level crash.
This widens the guard to `nargs >= 2 && nulls[1]` so it catches
start-is-null in both the 2-arg and 3-arg forms. `nulls[2]` is still only
checked when `nargs == 3`. No behaviour change on any non-null path; the
connection-crash case is now reported as a normal query error, matching the
intent the existing error message already implies.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
