psql: Avoid returning oom_buffer from psql slash command scanner psql_scan_slash_command() builds the command name in a local PQExpBufferData and returns the buffer's data pointer to its caller. If either the initial allocation or a later enlargement failed, that data pointer could be the static PQExpBuffer OOM buffer rather than malloc-owned storage. HandleSlashCmds() could then eventually pass it to free(), causing undefined behavior.
Detect a broken command-name buffer before returning it, report OOM, and return NULL instead. Teach HandleSlashCmds() to treat a NULL command name as a command error before trying to compare or dispatch it. Backpatch to all supported versions. Reported-by: Junwang Zhao <[email protected]> Author: Fujii Masao <[email protected]> Reviewed-by: Chao Li <[email protected]> Reviewed-by: Junwang Zhao <[email protected]> Discussion: https://postgr.es/m/CAHGQGwEh3R3=1tx_a5=ftdj+ycuwxwmen6bg_yt4b5p+he7...@mail.gmail.com Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b57f962201b248c65d6034176871b28bc04072dc Modified Files -------------- src/bin/psql/command.c | 4 +++- src/bin/psql/psqlscanslash.l | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-)
