plperl: Fix NULL pointer dereference for forged array object

In get_perl_array_ref(), for a PostgreSQL::InServer::ARRAY object, we
look up its "array" key with hv_fetch_string() and then inspect the
returned SV.  However, hv_fetch_string() returns a NULL pointer when
the key is absent, and the code dereferenced that result without first
checking whether the pointer itself was NULL.  As a result, a plperl
function returning a forged PostgreSQL::InServer::ARRAY object that
lacks the "array" key would crash the backend with a segmentation
fault.

Fix this by checking the pointer returned by hv_fetch_string() before
dereferencing it, matching how other callers in this file already
guard the result.  With the check in place, such an object falls
through to the existing error report instead of crashing.

Author: Xing Guo <higuoxing@gmail.com>
Reviewed-by: Richard Guo <guofenglinux@gmail.com>
Discussion: https://postgr.es/m/CACpMh+DYgcnqZwQLXXuxQcehJTd7T8UmKWSLsK4mFBEp9G2ajA@mail.gmail.com
Backpatch-through: 14

diff --git a/src/pl/plperl/expected/plperl_array.out b/src/pl/plperl/expected/plperl_array.out
index 260a55ea7e9b98ec7521198d897a7abefd8a6d47..f5803e10a6e2e23e7276d6807e695109b3738ebd 100644 (file)
--- a/src/pl/plperl/expected/plperl_array.out
+++ b/src/pl/plperl/expected/plperl_array.out
@@ -274,3 +274,10 @@ select perl_setof_array('{{1}, {2}, {3}}');
  {3}
 (3 rows)
 
+-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
+CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
+       return bless {}, "PostgreSQL::InServer::ARRAY";
+$$ LANGUAGE plperl;
+SELECT perl_forged_array();
+ERROR:  could not get array reference from PostgreSQL::InServer::ARRAY object
+CONTEXT:  PL/Perl function "perl_forged_array"

diff --git a/src/pl/plperl/plperl.c b/src/pl/plperl/plperl.c
index c1f9b8932a361bfcd3e408c70cbf3fcec88db694..9ddb81d42b93bce6cb9e1a4684fb1d3797911ee0 100644 (file)
--- a/src/pl/plperl/plperl.c
+++ b/src/pl/plperl/plperl.c
@@ -1154,7 +1154,7 @@ get_perl_array_ref(SV *sv)
                        HV                 *hv = (HV *) SvRV(sv);
                        SV                **sav = hv_fetch_string(hv, "array");
 
-                       if (*sav && SvOK(*sav) && SvROK(*sav) &&
+                       if (sav && *sav && SvOK(*sav) && SvROK(*sav) &&
                                SvTYPE(SvRV(*sav)) == SVt_PVAV)
                                return *sav;
 

diff --git a/src/pl/plperl/sql/plperl_array.sql b/src/pl/plperl/sql/plperl_array.sql
index ca63b5db62593260022f4b9efb6a1a1198f134d3..cd1d7e34c5078c82fd93f00e9904fee8ec6c6966 100644 (file)
--- a/src/pl/plperl/sql/plperl_array.sql
+++ b/src/pl/plperl/sql/plperl_array.sql
@@ -206,3 +206,10 @@ create or replace function perl_setof_array(integer[]) returns setof integer[] l
 $$;
 
 select perl_setof_array('{{1}, {2}, {3}}');
+
+-- Test a forged PostgreSQL::InServer::ARRAY object lacking the 'array' key
+CREATE OR REPLACE FUNCTION perl_forged_array() RETURNS integer[] AS $$
+       return bless {}, "PostgreSQL::InServer::ARRAY";
+$$ LANGUAGE plperl;
+
+SELECT perl_forged_array();