psql: Avoid returning oom_buffer from psql slash option scanner psql_scan_slash_option() builds option text in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. The callers could then eventually pass it to free(), causing undefined behavior.
Detect a broken option buffer before returning it, report OOM, and return NULL instead. Also avoid evaluating a backtick substitution when the option buffer is already broken, since doing so could otherwise touch the static OOM buffer. This keeps the existing NULL-return convention for slash options. Callers are not generally changed to distinguish OOM from no option. Backpatch to all supported versions. Reported-by: Junwang Zhao <[email protected]> Author: Fujii Masao <[email protected]> Reviewed-by: Chao Li <[email protected]> Reviewed-by: Junwang Zhao <[email protected]> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=ftdj+ycuwxwmen6bg_yt4b5p+he7...@mail.gmail.com Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/de38e72a199117ef69d7653f91f849626b4dcf3b Modified Files -------------- src/bin/psql/command.c | 2 +- src/bin/psql/psqlscanslash.l | 24 ++++++++++++++++++++++-- 2 files changed, 23 insertions(+), 3 deletions(-)
