From f604cc695cb52e2751710c890dbf10accffbd0c8 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Tue, 17 Feb 2026 08:41:37 +0900 Subject: [PATCH] hstore: Fix NULL pointer dereference with receive function The receive function of hstore was not able to handle correctly duplicate key values when a new duplicate links to a NULL value, where a pfree() could be attempted on a NULL pointer, crashing due to a pointer dereference. This problem would happen for a COPY BINARY, when stacking values like that: aa => 5 aa => null The second key/value pair is discarded and pfree() calls are attempted on its key and its value, leading to a pointer dereference for the value part as the value is NULL. The first key/value pair takes priority when a duplicate is found. Per offline report. Reported-by: "Anemone" Reported-by: "A1ex" Backpatch-through: 14 --- contrib/hstore/hstore_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/contrib/hstore/hstore_io.c b/contrib/hstore/hstore_io.c index 0b1e0581e84..da4d9d7fb95 100644 --- a/contrib/hstore/hstore_io.c +++ b/contrib/hstore/hstore_io.c @@ -346,7 +346,8 @@ hstoreUniquePairs(Pairs *a, int32 l, int32 *buflen) if (ptr->needfree) { pfree(ptr->key); - pfree(ptr->val); + if (ptr->val != NULL) + pfree(ptr->val); } } else