MIME-Version: 1.0
References: <19476-bd04ea6241345303@postgresql.org>
 <CAJTYsWVuNPbqS2p1gEitRLBHuytqM7OMawuzVH6g4uqGw4RBsQ@mail.gmail.com>
 <1357efa6-dddb-4e60-ba6f-e88d03a4e010@gmail.com>
In-Reply-To: <1357efa6-dddb-4e60-ba6f-e88d03a4e010@gmail.com>
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Wed, 13 May 2026 00:57:47 +0530
Message-ID: 
 <CAJTYsWWh5qsJcLatT5HD9daTEbCnZUZoqaDPGiT=+EyHkEKJ2A@mail.gmail.com>
Subject: Re: BUG #19476: Segmentation fault in contrib/spi
To: pierre.forstmann@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="00000000000064213b0651a3dc25"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJTYsWWh5qsJcLatT5HD9daTEbCnZUZoqaDPGiT%3D%2BEyHkEKJ2A%40mail.gmail.com>
Precedence: bulk

--00000000000064213b0651a3dc25
Content-Type: multipart/alternative; boundary="00000000000064213b0651a3dc23"

--00000000000064213b0651a3dc23
Content-Type: text/plain; charset="UTF-8"

Hi,


On Wed, 13 May 2026 at 00:22, <pierre.forstmann@gmail.com> wrote:

> Hello,
>
> You have not used the very last version of refint.c which has been updated
> just yesterday:
>
> commit 1ebda7da9a43d3ae3564d08612de9cb27fbaf482
> Author: Nathan Bossart <nathan@postgresql.org>
> Date:   Mon May 11 05:13:48 2026 -0700
>
>     refint: Fix SQL injection and buffer overruns.
>
>     Maliciously crafted key value updates could achieve SQL injection
>     within check_foreign_key().  To fix, ensure new key values are
>     properly quoted and escaped in the internally generated SQL
>     statements.  While at it, avoid potential buffer overruns by
>     replacing the stack buffers for internally generated SQL statements
>     with StringInfo.
>
>     Reported-by: Nikolay Samokhvalov <nik@postgres.ai>
>     Author: Nathan Bossart <nathandbossart@gmail.com>
>     Reviewed-by: Noah Misch <noah@leadboat.com>
>     Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
>     Reviewed-by: Fujii Masao <masao.fujii@gmail.com>
>     Security: CVE-2026-6637
>     Backpatch-through: 14
>
>
You're right, thanks for catching this.  I sent the v1 patches against
master from the day before; commit 260e97733bf (CVE-2026-6637) landed
in between and I had not noticed it.  That commit rewrites the same
cascade-update path to use StringInfo and quote_literal_cstr(), so the
v1 patches do not apply on current master at all.

Importantly, after 260e97733bf the bug is also no longer dependent on
_FORTIFY_SOURCE: the new code calls quote_literal_cstr(nv) directly,
which dereferences nv via strlen() and segfaults on stock builds too.
I reproduced this on plain master built with --enable-cassert.

I have rebased the minimal fix on current master.  It is essentially
the same shape as the snippet you suggested -- emit the NULL keyword
directly when SPI_getvalue() returns NULL, otherwise pass through
quote_literal_cstr() as today.  Attached as v2-0001.

I dropped my earlier 0002 patch.  The CVE fix already addressed the
quoting/escaping concerns that motivated half of it.

Regards,
Ayush

--00000000000064213b0651a3dc23
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,<br><br></div><br><div class=3D"gmail_=
quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, =
13 May 2026 at 00:22, &lt;<a href=3D"mailto:pierre.forstmann@gmail.com">pie=
rre.forstmann@gmail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex">Hello,<br>
<br>
You have not used the very last version of refint.c which has been updated =
just yesterday:<br>
<br>
commit 1ebda7da9a43d3ae3564d08612de9cb27fbaf482<br>
Author: Nathan Bossart &lt;<a href=3D"mailto:nathan@postgresql.org" target=
=3D"_blank">nathan@postgresql.org</a>&gt;<br>
Date:=C2=A0 =C2=A0Mon May 11 05:13:48 2026 -0700<br>
<br>
=C2=A0 =C2=A0 refint: Fix SQL injection and buffer overruns.<br>
<br>
=C2=A0 =C2=A0 Maliciously crafted key value updates could achieve SQL injec=
tion<br>
=C2=A0 =C2=A0 within check_foreign_key().=C2=A0 To fix, ensure new key valu=
es are<br>
=C2=A0 =C2=A0 properly quoted and escaped in the internally generated SQL<b=
r>
=C2=A0 =C2=A0 statements.=C2=A0 While at it, avoid potential buffer overrun=
s by<br>
=C2=A0 =C2=A0 replacing the stack buffers for internally generated SQL stat=
ements<br>
=C2=A0 =C2=A0 with StringInfo.<br>
<br>
=C2=A0 =C2=A0 Reported-by: Nikolay Samokhvalov &lt;<a href=3D"mailto:nik@po=
stgres.ai" target=3D"_blank">nik@postgres.ai</a>&gt;<br>
=C2=A0 =C2=A0 Author: Nathan Bossart &lt;<a href=3D"mailto:nathandbossart@g=
mail.com" target=3D"_blank">nathandbossart@gmail.com</a>&gt;<br>
=C2=A0 =C2=A0 Reviewed-by: Noah Misch &lt;<a href=3D"mailto:noah@leadboat.c=
om" target=3D"_blank">noah@leadboat.com</a>&gt;<br>
=C2=A0 =C2=A0 Reviewed-by: Tom Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.us=
" target=3D"_blank">tgl@sss.pgh.pa.us</a>&gt;<br>
=C2=A0 =C2=A0 Reviewed-by: Fujii Masao &lt;<a href=3D"mailto:masao.fujii@gm=
ail.com" target=3D"_blank">masao.fujii@gmail.com</a>&gt;<br>
=C2=A0 =C2=A0 Security: CVE-2026-6637<br>
=C2=A0 =C2=A0 Backpatch-through: 14<br><br></blockquote><div><br></div>You&=
#39;re right, thanks for catching this.=C2=A0 I sent the v1 patches against=
<br>master from the day before; commit 260e97733bf (CVE-2026-6637) landed<b=
r>in between and I had not noticed it.=C2=A0 That commit rewrites the same<=
br>cascade-update path to use StringInfo and quote_literal_cstr(), so the<b=
r>v1 patches do not apply on current master at all.<br><br>Importantly, aft=
er 260e97733bf the bug is also no longer dependent on<br>_FORTIFY_SOURCE: t=
he new code calls quote_literal_cstr(nv) directly,<br>which dereferences nv=
 via strlen() and segfaults on stock builds too.<br>I reproduced this on pl=
ain master built with --enable-cassert.<br><br>I have rebased the minimal f=
ix on current master.=C2=A0 It is essentially<br>the same shape as the snip=
pet you suggested -- emit the NULL keyword<br>directly when SPI_getvalue() =
returns NULL, otherwise pass through<br>quote_literal_cstr() as today.=C2=
=A0 Attached as v2-0001.<br><br>I dropped my earlier 0002 patch.=C2=A0 The =
CVE fix already addressed the<br>quoting/escaping concerns that motivated h=
alf of it.<div><br>Regards,<br>Ayush</div></div></div>

--00000000000064213b0651a3dc23--

--00000000000064213b0651a3dc25
Content-Type: application/octet-stream;
	name="v2-0001-Fix-refint-cascade-UPDATE-crash-with-NULL-keys.patch"
Content-Disposition: attachment;
	filename="v2-0001-Fix-refint-cascade-UPDATE-crash-with-NULL-keys.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mp30v7q10>
X-Attachment-Id: f_mp30v7q10

RnJvbSAxZjJiMzE5MjA0YmEwZmFlMGZiZjEwNWUxZWI1MzE4NzljNjcyOTRiIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBeXVzaCBUaXdhcmkgPGF5dXNodGl3YXJpLnNsZzAxQGdtYWls
LmNvbT4KRGF0ZTogVHVlLCAxMiBNYXkgMjAyNiAxOToyMDowOCArMDAwMApTdWJqZWN0OiBbUEFU
Q0ggdjJdIEZpeCByZWZpbnQgY2FzY2FkZSBVUERBVEUgY3Jhc2ggd2l0aCBOVUxMIGtleXMKCmNo
ZWNrX2ZvcmVpZ25fa2V5KCkgYnVpbGRzIGNhc2NhZGUgVVBEQVRFIHF1ZXJpZXMgdXNpbmcgdGhl
IG5ldyBrZXkKdmFsdWUgcmV0cmlldmVkIGJ5IFNQSV9nZXR2YWx1ZSgpLiAgQWZ0ZXIgY29tbWl0
IDI2MGU5NzczM2JmCihDVkUtMjAyNi02NjM3KSBpdCBwYXNzZXMgdGhhdCB2YWx1ZSB0aHJvdWdo
IHF1b3RlX2xpdGVyYWxfY3N0cigpIHRvCnByb3Blcmx5IGVzY2FwZSBsaXRlcmFscyBpbiB0aGUg
Z2VuZXJhdGVkIFNRTC4KCldoZW4gdGhlIG5ldyBrZXkgdmFsdWUgaXMgTlVMTCwgaG93ZXZlciwg
U1BJX2dldHZhbHVlKCkgcmV0dXJucyBhIE5VTEwKcG9pbnRlciwgd2hpY2ggcXVvdGVfbGl0ZXJh
bF9jc3RyKCkgdGhlbiBkZXJlZmVyZW5jZXMgaW4gaXRzIHN0cmxlbigpCmNhbGwsIGNyYXNoaW5n
IHRoZSBiYWNrZW5kLgoKRW1pdCB0aGUgU1FMIE5VTEwga2V5d29yZCBkaXJlY3RseSB3aGVuIFNQ
SV9nZXR2YWx1ZSgpIHJldHVybnMgTlVMTC4KClJlcG9ydGVkLWJ5OiBOaWtpdGEgS2FsaW5pbiA8
bi5rYWxpbmluQHBvc3RncmVzcHJvLnJ1PgpEaXNjdXNzaW9uOiBodHRwczovL3Bvc3Rnci5lcy9t
LzE5NDc2LWJkMDRlYTYyNDEzNDUzMDNAcG9zdGdyZXNxbC5vcmcKLS0tCiBjb250cmliL3NwaS9y
ZWZpbnQuYyB8IDEzICsrKysrKysrKysrLS0KIDEgZmlsZSBjaGFuZ2VkLCAxMSBpbnNlcnRpb25z
KCspLCAyIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2NvbnRyaWIvc3BpL3JlZmludC5jIGIv
Y29udHJpYi9zcGkvcmVmaW50LmMKaW5kZXggYzQ0Yzg3YmNkOTYuLjU0MjhiNTExYzE2IDEwMDY0
NAotLS0gYS9jb250cmliL3NwaS9yZWZpbnQuYworKysgYi9jb250cmliL3NwaS9yZWZpbnQuYwpA
QCAtNDg2LDggKzQ4NiwxNyBAQCBjaGVja19mb3JlaWduX2tleShQR19GVU5DVElPTl9BUkdTKQog
CQkJCQkJQXNzZXJ0KGZuID4gMCk7IC8qIGFscmVhZHkgY2hlY2tlZCBhYm92ZSAqLwogCQkJCQkJ
bnYgPSBTUElfZ2V0dmFsdWUobmV3dHVwbGUsIHR1cGRlc2MsIGZuKTsKIAotCQkJCQkJYXBwZW5k
U3RyaW5nSW5mbygmc3FsLCAiICVzID0gJXMgIiwKLQkJCQkJCQkJCQkgYXJnczJba10sIHF1b3Rl
X2xpdGVyYWxfY3N0cihudikpOworCQkJCQkJLyoKKwkJCQkJCSAqIFNQSV9nZXR2YWx1ZSgpIHJl
dHVybnMgTlVMTCBmb3IgU1FMIE5VTEwgdmFsdWVzLgorCQkJCQkJICogRW1pdCB0aGUgTlVMTCBr
ZXl3b3JkIGRpcmVjdGx5IHJhdGhlciB0aGFuIHBhc3NpbmcKKwkJCQkJCSAqIGEgTlVMTCBwb2lu
dGVyIHRvIHF1b3RlX2xpdGVyYWxfY3N0cigpLCB3aGljaCB3b3VsZAorCQkJCQkJICogZGVyZWZl
cmVuY2UgaXQuCisJCQkJCQkgKi8KKwkJCQkJCWlmIChudiA9PSBOVUxMKQorCQkJCQkJCWFwcGVu
ZFN0cmluZ0luZm8oJnNxbCwgIiAlcyA9IE5VTEwgIiwgYXJnczJba10pOworCQkJCQkJZWxzZQor
CQkJCQkJCWFwcGVuZFN0cmluZ0luZm8oJnNxbCwgIiAlcyA9ICVzICIsCisJCQkJCQkJCQkJCSBh
cmdzMltrXSwgcXVvdGVfbGl0ZXJhbF9jc3RyKG52KSk7CiAJCQkJCQlpZiAoayA8IG5rZXlzKQog
CQkJCQkJCWFwcGVuZFN0cmluZ0luZm9TdHJpbmcoJnNxbCwgIiwgIik7CiAJCQkJCX0KLS0gCjIu
NDMuMAoK
--00000000000064213b0651a3dc25--