Hi Eugeny, On Fri, Jan 23, 2026 at 5:41 PM Eugeny Goryachev <[email protected]> wrote:
> Hi hackers, > > While reviewing the MatchText function in backend/utils/adt/like_match.c, > I noticed a potential NULL pointer dereference when using LIKE or ILIKE > with the C locale. > > The issue arises because the locale argument (of type pg_locale_t, which > is a pointer) can be NULL when the C collation is in use. However, the > GETCHAR macro unconditionally passes this locale to MATCH_LOWER, which - > depending on its definition - may attempt to dereference it (e.g., to > access locale->provider or other fields). > > This can lead to a crash in builds or configurations where MATCH_LOWER is > not safe to call with a NULL locale. > > The proposed patch adds an explicit check for locale == NULL in the > GETCHAR macro and falls back to pg_ascii_tolower() in that case, which is > both safe and correct for the C locale (since no locale-specific case > folding is needed). > > The change aligns with existing patterns in the codebase (e.g., in > text_cmp and other collation-aware functions) where NULL locale is > treated as equivalent to C/POSIX behavior. > > Best regards, Eugeny Goryachev. > > Patch: > Subject: [PATCH] Avoid potential NULL dereference in LIKE/ILIKE with C > locale > > --- > src/backend/utils/adt/like_match.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/src/backend/utils/adt/like_match.c > b/src/backend/utils/adt/like_match.c > index 892f8a745ea..884edc7ff42 100644 > --- a/src/backend/utils/adt/like_match.c > +++ b/src/backend/utils/adt/like_match.c > @@ -71,7 +71,8 @@ > */ > > #ifdef MATCH_LOWER > -#define GETCHAR(t, locale) MATCH_LOWER(t, locale) > +#define GETCHAR(t, locale) \ > + ((locale) == 0 ? pg_ascii_tolower((unsigned char)(t)) : MATCH_LOWER(t, > locale)) > #else > #define GETCHAR(t, locale) (t) > #endif > -- > 2.42.4 > This issue appears to have already been fixed in commit 1e493158d3d25771ed066028c00cbbdb41573496. Discussion: https://postgr.es/m/[email protected]
