This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 02397f95193dc61c7a12a013d1a818d31ad7d167 Author: Tom Lane <[email protected]> AuthorDate: Mon Aug 10 06:38:25 2026 -0700 Save/restore more lexer state when skipping text due to \if. When we implemented \if ... \endif in psql, we arranged to save/restore the lexer's parenthesis depth counter across any chunk of input that we're ignoring. At the time, that was sufficient, because no other part of PsqlScanState could need to be restored to its prior value. However, commit e717a9a18 and follow-ons added more state fields that ought to be restored to their prior values. A problem would only be observed if someone tries to \if out a portion of a CREATE FUNCTION/PROCEDURE command that is relevant to BEGIN/END matching, which seems like a pretty unusual usage, so the lack of field reports isn't surprising. Nonetheless it's a bug. To fix, replace the simple counter field in ConditionalStack entries with a pointer to a struct defined by psqlscan_int.h. (In the back branches, keep the old field and associated functions to minimize the risk of API/ABI breakage, even though it seems unlikely that any third-party code is using this. Making the new struct private to psqlscan-related code should prevent API/ABI issues for future additions of this type.) In itself this is only a minor bug fix, but it's prerequisite infrastructure for the fix for CVE-2026-6464, which will add another such field. Author: Tom Lane <[email protected]> Reviewed-by: Noah Misch <[email protected]> Backpatch-through: 14 Security: CVE-2026-6464 --- src/bin/psql/command.c | 16 +++++++--------- src/bin/psql/psqlscanslash.h | 5 +++++ src/bin/psql/psqlscanslash.l | 38 +++++++++++++++++++++++++++++++++++++ src/fe_utils/conditional.c | 34 +++++++++++++++++++++++++++++++++ src/include/fe_utils/conditional.h | 17 +++++++++++------ src/include/fe_utils/psqlscan.h | 3 +++ src/include/fe_utils/psqlscan_int.h | 17 +++++++++++++++++ src/test/regress/expected/psql.out | 16 ++++++++++++++++ src/test/regress/sql/psql.sql | 11 +++++++++++ src/tools/pgindent/typedefs.list | 1 + 10 files changed, 143 insertions(+), 15 deletions(-) diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c index 81859e02ae6..ccd11f586b3 100644 --- a/src/bin/psql/command.c +++ b/src/bin/psql/command.c @@ -3246,8 +3246,8 @@ is_branching_command(const char *cmd) * Prepare to possibly restore query buffer to its current state * (cf. discard_query_text). * - * We need to remember the length of the query buffer, and the lexer's - * notion of the parenthesis nesting depth. + * We need to remember the length of the query buffer, and assorted + * lexer internal state such as parenthesis nesting depth. */ static void save_query_text_state(PsqlScanState scan_state, ConditionalStack cstack, @@ -3255,8 +3255,8 @@ save_query_text_state(PsqlScanState scan_state, ConditionalStack cstack, { if (query_buf) conditional_stack_set_query_len(cstack, query_buf->len); - conditional_stack_set_paren_depth(cstack, - psql_scan_get_paren_depth(scan_state)); + conditional_stack_set_lex_state(cstack, + psql_scan_get_lex_state(scan_state)); } /* @@ -3265,9 +3265,7 @@ save_query_text_state(PsqlScanState scan_state, ConditionalStack cstack, * We must discard data that was appended to query_buf during an inactive * \if branch. We don't have to do anything there if there's no query_buf. * - * Also, reset the lexer state to the same paren depth there was before. - * (The rest of its state doesn't need attention, since we could not be - * inside a comment or literal or partial token.) + * Also, reset the lexer's state to what it was before. */ static void discard_query_text(PsqlScanState scan_state, ConditionalStack cstack, @@ -3281,8 +3279,8 @@ discard_query_text(PsqlScanState scan_state, ConditionalStack cstack, query_buf->len = new_len; query_buf->data[new_len] = '\0'; } - psql_scan_set_paren_depth(scan_state, - conditional_stack_get_paren_depth(cstack)); + psql_scan_set_lex_state(scan_state, + conditional_stack_get_lex_state(cstack)); } /* diff --git a/src/bin/psql/psqlscanslash.h b/src/bin/psql/psqlscanslash.h index 7724242f371..3515cb1e96f 100644 --- a/src/bin/psql/psqlscanslash.h +++ b/src/bin/psql/psqlscanslash.h @@ -31,6 +31,11 @@ extern char *psql_scan_slash_option(PsqlScanState state, extern void psql_scan_slash_command_end(PsqlScanState state); +extern PsqlScanStateSave *psql_scan_get_lex_state(PsqlScanState state); + +extern void psql_scan_set_lex_state(PsqlScanState state, + const PsqlScanStateSave *lex_state); + extern int psql_scan_get_paren_depth(PsqlScanState state); extern void psql_scan_set_paren_depth(PsqlScanState state, int depth); diff --git a/src/bin/psql/psqlscanslash.l b/src/bin/psql/psqlscanslash.l index b56d443ac4a..193c0541aec 100644 --- a/src/bin/psql/psqlscanslash.l +++ b/src/bin/psql/psqlscanslash.l @@ -701,8 +701,46 @@ psql_scan_slash_command_end(PsqlScanState state) psql_scan_reselect_sql_lexer(state); } +/* + * Save current lexer state + * + * Relevant parts of the state are returned in a pg_malloc'd struct. + * It is caller's responsibility to free the struct eventually. + */ +PsqlScanStateSave * +psql_scan_get_lex_state(PsqlScanState state) +{ + PsqlScanStateSave *lex_state = pg_malloc_object(PsqlScanStateSave); + StaticAssertDecl(sizeof(lex_state->identifiers) == sizeof(state->identifiers), + "identifiers array lengths must match"); + + lex_state->paren_depth = state->paren_depth; + lex_state->begin_depth = state->begin_depth; + lex_state->identifier_count = state->identifier_count; + memcpy(lex_state->identifiers, state->identifiers, + sizeof(lex_state->identifiers)); + return lex_state; +} + +/* + * Restore lexer state to what it was when saved + */ +void +psql_scan_set_lex_state(PsqlScanState state, + const PsqlScanStateSave *lex_state) +{ + state->paren_depth = lex_state->paren_depth; + state->begin_depth = lex_state->begin_depth; + state->identifier_count = lex_state->identifier_count; + memcpy(state->identifiers, lex_state->identifiers, + sizeof(state->identifiers)); +} + /* * Fetch current paren nesting depth + * + * (These functions are obsolete, and kept around only to avoid API/ABI + * breakage in the back branches.) */ int psql_scan_get_paren_depth(PsqlScanState state) diff --git a/src/fe_utils/conditional.c b/src/fe_utils/conditional.c index e67fb0dbe8c..07acd5d0ab6 100644 --- a/src/fe_utils/conditional.c +++ b/src/fe_utils/conditional.c @@ -57,6 +57,7 @@ conditional_stack_push(ConditionalStack cstack, ifState new_state) p->if_state = new_state; p->query_len = -1; p->paren_depth = -1; + p->lex_state = NULL; p->next = cstack->head; cstack->head = p; } @@ -73,6 +74,8 @@ conditional_stack_pop(ConditionalStack cstack) if (!p) return false; cstack->head = cstack->head->next; + if (p->lex_state) + free(p->lex_state); free(p); return true; } @@ -166,8 +169,39 @@ conditional_stack_get_query_len(ConditionalStack cstack) return cstack->head->query_len; } +/* + * Save current lexer state in topmost stack entry. + * + * The lexer state is presumed to be a single pg_malloc'd chunk. + * It will be freed automatically when the stack entry is popped. + */ +void +conditional_stack_set_lex_state(ConditionalStack cstack, + struct PsqlScanStateSave *lex_state) +{ + Assert(!conditional_stack_empty(cstack)); + if (cstack->head->lex_state) /* free old state, if any */ + free(cstack->head->lex_state); + cstack->head->lex_state = lex_state; +} + +/* + * Fetch last-recorded lexer state from topmost stack entry. + * Will return NULL if no stack or it was never saved. + */ +struct PsqlScanStateSave * +conditional_stack_get_lex_state(ConditionalStack cstack) +{ + if (conditional_stack_empty(cstack)) + return NULL; + return cstack->head->lex_state; +} + /* * Save current parenthesis nesting depth in topmost stack entry. + * + * (These functions are obsolete, and kept around only to avoid API/ABI + * breakage in the back branches.) */ void conditional_stack_set_paren_depth(ConditionalStack cstack, int depth) diff --git a/src/include/fe_utils/conditional.h b/src/include/fe_utils/conditional.h index 36e72c977ce..e7bfc1136f8 100644 --- a/src/include/fe_utils/conditional.h +++ b/src/include/fe_utils/conditional.h @@ -49,18 +49,18 @@ typedef enum ifState * query_len is used to determine what accumulated text to throw away at the * end of an inactive branch. (We could, perhaps, teach the lexer to not add * stuff to the query buffer in the first place when inside an inactive branch; - * but that would be very invasive.) We also need to save and restore the - * lexer's parenthesis nesting depth when throwing away text. (We don't need - * to save and restore any of its other state, such as comment nesting depth, - * because a backslash command could never appear inside a comment or SQL - * literal.) + * but that would be very invasive.) We also need to save and restore some + * lexer state, such as parenthesis nesting depth, when throwing away text. */ +struct PsqlScanStateSave; /* opaque outside lexer */ + typedef struct IfStackElem { ifState if_state; /* current state, see enum above */ int query_len; /* length of query_buf at last branch start */ - int paren_depth; /* parenthesis depth at last branch start */ + int paren_depth; /* (obsolete, not used anymore) */ struct IfStackElem *next; /* next surrounding \if, if any */ + struct PsqlScanStateSave *lex_state; /* lexer state at last branch start */ } IfStackElem; typedef struct ConditionalStackData @@ -95,6 +95,11 @@ extern void conditional_stack_set_query_len(ConditionalStack cstack, int len); extern int conditional_stack_get_query_len(ConditionalStack cstack); +extern void conditional_stack_set_lex_state(ConditionalStack cstack, + struct PsqlScanStateSave *lex_state); + +extern struct PsqlScanStateSave *conditional_stack_get_lex_state(ConditionalStack cstack); + extern void conditional_stack_set_paren_depth(ConditionalStack cstack, int depth); extern int conditional_stack_get_paren_depth(ConditionalStack cstack); diff --git a/src/include/fe_utils/psqlscan.h b/src/include/fe_utils/psqlscan.h index 6a90fcab9eb..2084814ecdd 100644 --- a/src/include/fe_utils/psqlscan.h +++ b/src/include/fe_utils/psqlscan.h @@ -26,6 +26,9 @@ /* Abstract type for lexer's internal state */ typedef struct PsqlScanStateData *PsqlScanState; +/* Abstract type for state save/restore */ +typedef struct PsqlScanStateSave PsqlScanStateSave; + /* Termination states for psql_scan() */ typedef enum { diff --git a/src/include/fe_utils/psqlscan_int.h b/src/include/fe_utils/psqlscan_int.h index 373e7e14763..a05dcd43613 100644 --- a/src/include/fe_utils/psqlscan_int.h +++ b/src/include/fe_utils/psqlscan_int.h @@ -131,6 +131,23 @@ typedef struct PsqlScanStateData void *cb_passthrough; } PsqlScanStateData; +/* + * Conditional scanning (\if ... \endif) needs to be able to reset the + * lexer's state to what it was at the beginning of a chunk of text that + * we choose to ignore. PsqlScanStateSave holds the values that need + * to be saved and restored. We assume that saving/restoring happens only + * while processing a backslash command, so we needn't save state that is + * concerned with comment or SQL literal processing: we won't be inside + * one of those. + */ +struct PsqlScanStateSave +{ + int paren_depth; /* depth of nesting in parentheses */ + int begin_depth; /* depth of begin/end pairs */ + int identifier_count; /* identifiers since start of statement */ + char identifiers[4]; /* records the first few identifiers */ +}; + /* * Functions exported by psqlscan.l, but only meant for use within diff --git a/src/test/regress/expected/psql.out b/src/test/regress/expected/psql.out index ab8f55b7358..12029d5cfd0 100644 --- a/src/test/regress/expected/psql.out +++ b/src/test/regress/expected/psql.out @@ -4659,6 +4659,22 @@ invalid command \lo \echo 'should print #8-1' should print #8-1 \endif +-- test that begin/end matching ignores to-be-ignored text +create function silly_function(int) returns int +begin atomic select $1; +\if false +end +\endif +; +end; +\sf silly_function(int) +CREATE OR REPLACE FUNCTION public.silly_function(integer) + RETURNS integer + LANGUAGE sql +BEGIN ATOMIC + SELECT $1; +END +drop function silly_function(int); -- :{?...} defined variable test \set i 1 \if :{?i} diff --git a/src/test/regress/sql/psql.sql b/src/test/regress/sql/psql.sql index 574843cc00e..aaadadb4da5 100644 --- a/src/test/regress/sql/psql.sql +++ b/src/test/regress/sql/psql.sql @@ -1044,6 +1044,17 @@ select \if false \\ (bogus \else \\ 42 \endif \\ forty_two; \echo 'should print #8-1' \endif +-- test that begin/end matching ignores to-be-ignored text +create function silly_function(int) returns int +begin atomic select $1; +\if false +end +\endif +; +end; +\sf silly_function(int) +drop function silly_function(int); + -- :{?...} defined variable test \set i 1 \if :{?i} diff --git a/src/tools/pgindent/typedefs.list b/src/tools/pgindent/typedefs.list index 0b1b1df3b4a..7598eb60780 100644 --- a/src/tools/pgindent/typedefs.list +++ b/src/tools/pgindent/typedefs.list @@ -2177,6 +2177,7 @@ PsqlScanQuoteType PsqlScanResult PsqlScanState PsqlScanStateData +PsqlScanStateSave PsqlSettings Publication PublicationActions --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
