From d7bb9f643b374112cf806b40def8e3783493ebc2 Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Thu, 16 Jul 2026 13:38:34 +0900 Subject: [PATCH] Check CREATE_REPLICATION_SLOT response shape in libpqwalreceiver Previously, libpqrcv_create_slot() checked only that CREATE_REPLICATION_SLOT returned PGRES_TUPLES_OK before reading values from the first row. If the server unexpectedly returned an invalid result, such as zero rows, PQgetvalue() could return NULL, leading to a crash while parsing the LSN. Other replication commands, such as IDENTIFY_SYSTEM, already validate the response shape before accessing result values, but CREATE_REPLICATION_SLOT did not. Fix this by verifying that CREATE_REPLICATION_SLOT response contains exactly one row with four fields, and report a protocol violation otherwise. Backpatch to all supported versions. Bug: #19547 Reported-by: Yuelin Wang <1217816127@qq.com> Author: Kenny Chen Reviewed-by: Hayato Kuroda Reviewed-by: Fujii Masao Discussion: https://postgr.es/m/19547-f7986f668f71e788@postgresql.org Discussion: https://postgr.es/m/CAPXstDtW2iqe+DJAOTQTX+rRziJp2UhZSo1+HRj1COAtbu+nKw@mail.gmail.com Backpatch-through: 14 --- .../replication/libpqwalreceiver/libpqwalreceiver.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c index e0ba1fbc4ff..7b6795c9b59 100644 --- a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c +++ b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c @@ -1101,6 +1101,14 @@ libpqrcv_create_slot(WalReceiverConn *conn, const char *slotname, slotname, pchomp(PQerrorMessage(conn->streamConn))))); } + /* CREATE_REPLICATION_SLOT returns a single row with four columns */ + if (PQnfields(res) != 4 || PQntuples(res) != 1) + ereport(ERROR, + (errcode(ERRCODE_PROTOCOL_VIOLATION), + errmsg("invalid response from primary server"), + errdetail("Could not create replication slot \"%s\": got %d rows and %d fields, expected %d rows and %d fields.", + slotname, PQntuples(res), PQnfields(res), 1, 4))); + if (lsn) *lsn = DatumGetLSN(DirectFunctionCall1Coll(pg_lsn_in, InvalidOid, CStringGetDatum(PQgetvalue(res, 0, 1)))); -- 2.47.3