BUG #18981: Fault tolerance and improvement for xmltotext_with_options (xml.c) - Mailing list pgsql-bugs

From PG Bug reporting form
Subject BUG #18981: Fault tolerance and improvement for xmltotext_with_options (xml.c)
Date
Msg-id 18981-9bc3c80f107ae925@postgresql.org
Whole thread Raw
Responses Re: BUG #18981: Fault tolerance and improvement for xmltotext_with_options (xml.c)
List pgsql-bugs
The following bug has been logged on the website:

Bug reference:      18981
Logged by:          Dmitry Kovalenko
Email address:      d.kovalenko@postgrespro.ru
PostgreSQL version: 18beta1
Operating system:   any
Description:

Hello,
Please look at this code:
https://github.com/postgres/postgres/blob/a27893df45ec5d8c657899202e9cf0b9a816fe2f/src/backend/utils/adt/xml.c#L730
xmlerrcxt = pg_xml_init(PG_XML_STRICTNESS_ALL);
pg_xml_init uses palloc and may "raise an exception".
1)
https://github.com/postgres/postgres/blob/a27893df45ec5d8c657899202e9cf0b9a816fe2f/src/backend/utils/adt/xml.c#L1254
2)
https://github.com/postgres/postgres/blob/a27893df45ec5d8c657899202e9cf0b9a816fe2f/src/backend/utils/adt/xml.c#L1258
t it occurres we do not release 'doc' pointer and get memory leaks.
I offer to move a call of pg_xml_init in try{...}catch section
See this commit:
https://github.com/dmitry-lipetsk/postgres/commit/c66d2b05077a8d1f3057560303f3a82f7d717569
Also
Within PG_CATCH 'doc' is not NULL.

https://github.com/postgres/postgres/blob/a27893df45ec5d8c657899202e9cf0b9a816fe2f/src/backend/utils/adt/xml.c#L866-L867
It allocates before PG_TRY statement.
https://github.com/postgres/postgres/blob/a27893df45ec5d8c657899202e9cf0b9a816fe2f/src/backend/utils/adt/xml.c#L709
So, we can call xmlFreeDoc(doc) without a verification.
Thanks&Regards,
Dmitry Kovalenko


pgsql-bugs by date:

Previous
From: Tom Lane
Date:
Subject: Re: BUG #18980: Unable to perform make due to inability to resolve a variety of Undefined symbols arm64
Next
From: "Robin Haberkorn"
Date:
Subject: Re: BUG #18943: Return value of a function 'xmlBufferCreate' is dereferenced at xpath.c:177 without checking for NUL