Skip to content

Commit d9d5143

Browse files
michaelpqRucha Kulkarni
authored andcommitted
hstore: Fix NULL pointer dereference with receive function
The receive function of hstore was not able to handle correctly duplicate key values when a new duplicate links to a NULL value, where a pfree() could be attempted on a NULL pointer, crashing due to a pointer dereference. This problem would happen for a COPY BINARY, when stacking values like that: aa => 5 aa => null The second key/value pair is discarded and pfree() calls are attempted on its key and its value, leading to a pointer dereference for the value part as the value is NULL. The first key/value pair takes priority when a duplicate is found. Per offline report. Reported-by: "Anemone" <vergissmeinnichtzh@gmail.com> Reported-by: "A1ex" <alex000young@gmail.com> Backpatch-through: 14 (cherry picked from commit 0dfbe42da7f75833e807e281332594e73451894b)
1 parent 068ca76 commit d9d5143

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

contrib/hstore/hstore_io.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -382,7 +382,8 @@ hstoreUniquePairs(Pairs *a, int32 l, int32 *buflen)
382382
if (ptr->needfree)
383383
{
384384
pfree(ptr->key);
385-
pfree(ptr->val);
385+
if (ptr->val != NULL)
386+
pfree(ptr->val);
386387
}
387388
}
388389
else

0 commit comments

Comments
 (0)