xml2: Fix failure with xslt_process() under -fsanitize=undefined

The logic of xslt_process() has never considered the fact that
xsltSaveResultToString() would return NULL for an empty string (the
upstream code has always done so, with a string length of 0).  This
would cause memcpy() to be called with a NULL pointer, something
forbidden by POSIX.

Like 46ab07ffda9d and similar fixes, this is backpatched down to all the
supported branches, with a test case to cover this scenario.  An empty
string has been always returned in xml2 in this case, based on the
history of the module, so this is an old issue.

Reported-by: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/c516a0d9-4406-47e3-9087-5ca5176ebcf9@gmail.com
Backpatch-through: 14

diff --git a/contrib/xml2/expected/xml2.out b/contrib/xml2/expected/xml2.out
index 3d97b14c3a1e479519bb29c99a9ccc39ddb2613c..1906fcf33e2a5c0e9a6a1435aaf30c2464834dd2 100644 (file)
--- a/contrib/xml2/expected/xml2.out
+++ b/contrib/xml2/expected/xml2.out
@@ -261,3 +261,13 @@ $$<xsl:stylesheet version="1.0"
   </xsl:template>
 </xsl:stylesheet>$$);
 ERROR:  failed to apply stylesheet
+-- empty output
+select xslt_process('<aaa/>',
+$$<xsl:stylesheet version="1.0"
+      xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+</xsl:stylesheet>$$);
+ xslt_process 
+--------------
+ 
+(1 row)
+

diff --git a/contrib/xml2/expected/xml2_1.out b/contrib/xml2/expected/xml2_1.out
index 31700040a604b434338cab02eaaf0d29b71843d2..9a2144d58f577b902b7b74c4d311efe4171dda40 100644 (file)
--- a/contrib/xml2/expected/xml2_1.out
+++ b/contrib/xml2/expected/xml2_1.out
@@ -205,3 +205,9 @@ $$<xsl:stylesheet version="1.0"
   </xsl:template>
 </xsl:stylesheet>$$);
 ERROR:  xslt_process() is not available without libxslt
+-- empty output
+select xslt_process('<aaa/>',
+$$<xsl:stylesheet version="1.0"
+      xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+</xsl:stylesheet>$$);
+ERROR:  xslt_process() is not available without libxslt

diff --git a/contrib/xml2/sql/xml2.sql b/contrib/xml2/sql/xml2.sql
index ef99d164f2720c5e3ee999a7abd4b2c3b7c31c85..510d18a367996b8b56e7b943f7c424a62f1569f8 100644 (file)
--- a/contrib/xml2/sql/xml2.sql
+++ b/contrib/xml2/sql/xml2.sql
@@ -153,3 +153,9 @@ $$<xsl:stylesheet version="1.0"
     </sax:output>
   </xsl:template>
 </xsl:stylesheet>$$);
+
+-- empty output
+select xslt_process('<aaa/>',
+$$<xsl:stylesheet version="1.0"
+      xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+</xsl:stylesheet>$$);

diff --git a/contrib/xml2/xslt_proc.c b/contrib/xml2/xslt_proc.c
index 2be87bec0cdf7f95d5c8bb1bfeea0764e3aad433..8ceb8c464942f2bfeb9fee5dd93152530eda4232 100644 (file)
--- a/contrib/xml2/xslt_proc.c
+++ b/contrib/xml2/xslt_proc.c
@@ -146,7 +146,16 @@ xslt_process(PG_FUNCTION_ARGS)
                                                                                 restree, stylesheet);
 
                if (resstat >= 0)
-                       result = cstring_to_text_with_len((char *) resstr, reslen);
+               {
+                       /*
+                        * If an empty string has been returned, resstr would be NULL. In
+                        * this case, assume that the result is an empty string.
+                        */
+                       if (reslen == 0)
+                               result = cstring_to_text("");
+                       else
+                               result = cstring_to_text_with_len((char *) resstr, reslen);
+               }
        }
        PG_CATCH();
        {