Thread: BUG #18908: DEREF_OF_NULL: After having been assigned to a NULL value at descriptor.c:203

The following bug has been logged on the website:

Bug reference:      18908
Logged by:          Eugeny Goryachev
Email address:      gorcom2012@gmail.com
PostgreSQL version: 17.4
Operating system:   Ubuntu
Description:

DEREF_OF_NULL.EX.COND After having been assigned to a NULL value at
descriptor.c:203, pointer '0' is passed as 5th parameter in call to function
'ECPGdump_a_type' at descriptor.c:203, where it is dereferenced at
type.c:332.
In the file /src/interfaces/ecpg/preproc/descriptor.c, in the function
output_get_descr(), there is a call to ECPGdump_a_type() with an explicit
NULL passed as the 5th parameter:
void
output_get_descr(char *desc_name, char *index)
{
***
    ECPGdump_a_type(base_yyout, v->name, v->type, v->brace_level,
                    NULL, NULL, -1, NULL, NULL, str_zero, NULL, NULL);
***
}
This NULL parameter is then passed to the ECPGdump_a_struct() function,
where it gets dereferenced:
static void
ECPGdump_a_struct(FILE *o, const char *name, const char *ind_name, char
*arrsize, struct ECPGtype *type, struct ECPGtype *ind_type, const char
*prefix, const char *ind_prefix)
{
***
    char *pbuf = (char *) mm_alloc(strlen(name) + ((prefix == NULL) ? 0 :
strlen(prefix)) + 3);
***
}
When name == NULL, the strlen(name) call will cause a Segmentation Fault.
To fix this issue, I propose the following patch:
diff --git a/src/interfaces/ecpg/preproc/type.c
b/src/interfaces/ecpg/preproc/type.c
index a842bb6a1fe..7ffae74bcf2 100644
--- a/src/interfaces/ecpg/preproc/type.c
+++ b/src/interfaces/ecpg/preproc/type.c
@@ -587,7 +587,7 @@ ECPGdump_a_struct(FILE *o, const char *name, const char
*ind_name, char *arrsize
     struct ECPGstruct_member *p,
                *ind_p = NULL;
     char       *pbuf = (char *) mm_alloc(strlen(name) + ((prefix == NULL) ?
0 : strlen(prefix)) + 3);
-    char       *ind_pbuf = (char *) mm_alloc(strlen(ind_name) +
((ind_prefix == NULL) ? 0 : strlen(ind_prefix)) + 3);
+    char       *ind_pbuf = (char *) mm_alloc(((ind_name == NULL) ? 0 :
strlen(ind_name)) + ((ind_prefix == NULL) ? 0 : strlen(ind_prefix)) + 3);
     if (atoi(arrsize) == 1)
         sprintf(pbuf, "%s%s.", prefix ? prefix : "", name);