xml2: Fix failure with xslt_process() under -fsanitize=undefined

The logic of xslt_process() has never considered the fact that
xsltSaveResultToString() would return NULL for an empty string (the
upstream code has always done so, with a string length of 0).  This
would cause memcpy() to be called with a NULL pointer, something
forbidden by POSIX.

Like 46ab07ffda and similar fixes, this is backpatched down to all the
supported branches, with a test case to cover this scenario.  An empty
string has been always returned in xml2 in this case, based on the
history of the module, so this is an old issue.

Reported-by: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/c516a0d9-4406-47e3-9087-5ca5176ebcf9@gmail.com
Backpatch-through: 14
REL_15_STABLE
Michael Paquier 1 week ago
parent d0f4b6350d
commit 0b0041b942
  1. 10
      contrib/xml2/expected/xml2.out
  2. 6
      contrib/xml2/expected/xml2_1.out
  3. 6
      contrib/xml2/sql/xml2.sql
  4. 9
      contrib/xml2/xslt_proc.c

@ -222,3 +222,13 @@ $$<xsl:stylesheet version="1.0"
</xsl:template>
</xsl:stylesheet>$$);
ERROR: failed to apply stylesheet
-- empty output
select xslt_process('<aaa/>',
$$<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
</xsl:stylesheet>$$);
xslt_process
--------------
(1 row)

@ -166,3 +166,9 @@ $$<xsl:stylesheet version="1.0"
</xsl:template>
</xsl:stylesheet>$$);
ERROR: xslt_process() is not available without libxslt
-- empty output
select xslt_process('<aaa/>',
$$<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
</xsl:stylesheet>$$);
ERROR: xslt_process() is not available without libxslt

@ -137,3 +137,9 @@ $$<xsl:stylesheet version="1.0"
</sax:output>
</xsl:template>
</xsl:stylesheet>$$);
-- empty output
select xslt_process('<aaa/>',
$$<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
</xsl:stylesheet>$$);

@ -179,7 +179,14 @@ xslt_process(PG_FUNCTION_ARGS)
if (resstat < 0)
PG_RETURN_NULL();
result = cstring_to_text_with_len((char *) resstr, reslen);
/*
* If an empty string has been returned, resstr would be NULL. In
* this case, assume that the result is an empty string.
*/
if (reslen == 0)
result = cstring_to_text("");
else
result = cstring_to_text_with_len((char *) resstr, reslen);
if (resstr)
xmlFree(resstr);

Loading…
Cancel
Save