BUG #7811: strlen(NULL) cause psql crash - Mailing list pgsql-bugs

The following bug has been logged on the website:

Bug reference:      7811
Logged by:          Meng Qingzhong
Email address:      1584171677@qq.com
PostgreSQL version: 9.2.2
Operating system:   Windows 7
Description:        =


 I find a bug this time really and I have fixed it. The bug is in psql, my
oprating system is Windows 7, and the IDE is Visual Studio 2010. The version
of postgreSQL is 9.2.2
      I give you a description about how to trigger this bug first=EF=BC=9A
          (1) start the server with the command "postgres -D pgdata"
          (2) start the client with the command "psql"
          (3) close the server
          (4) execute a query from the client "slect *from t; ". At this
time, the client detected that it lost the connection with the server.
          (5) execute the following command from the client "\?", then the
client will crash.

      I have found the reason which caused that.

          (1) When the client execute "slect *from t; ", it execute the
function "ResetCancelConn()" at line 364 in src\bin\psql\common.c ,and the
function set pset.db to NULL.
          (2) When the client execute "\?", it execute the function fprintf
at line 254 in help.c. The value returned by PQdb(pset.db) is an argument of
 fprintf, and at this time   PQdb returned NULL.
          (3) This NULL was finally passed to strlen at line 779 in
snprintf.c through several simple fuction calls, so psql crashed.
         =

      I hava fixed the bug in the following way which may be not the best:

          (1) add a string named strofnull, and in the function "dopr" in
file src\port\snprintf.c
                  char *strofnull=3D"(null)";

          (2) add an if statment before calling fmtstr at about line 720 in
file src\port\snprintf.c

                  if (strvalue=3D=3DNULL)
          {
                  strvalue=3Dstrofnull;
          }