From 1d094904bc76b57fa1fd634b9c49bbb5ab76ece7 Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Thu, 17 Sep 2026 14:52:30 +0200 Subject: [PATCH] Fix postmaster crash on whitespace-only oauth_validator_libraries The check_oauth_validator check for an empty validator list didn't test for a string with only whitespace, which would cause the postmaster to crash. Instead of testing for the empty string cases, pass the config value to SplitDirectoriesString unconditionally. If an empty list is returned then the input string was empty. Since pstrdup cannot handle NULL, assert that the string ie set. While users cannot set the string to NULL, it is initialized to NULL so guard against programmer error. Check the parsed list instead. Assert that the GUC string is non-NULL before pstrdup(); users cannot set it to NULL, but the C variable is initialized that way. This also adds a TAP test that reloads a whitespace-only setting after pg_hba_file_rules and waits until the existing backend sees the restored GUC. Author: Grigorev Jurij Reviewed-by: Jacob Champion Reviewed-by: Daniel Gustafsson Discussion: https://postgr.es/m/04fa84f6ebbe400f940e179ebe1070e9@localhost.localdomain Backpatch-through: 18 --- src/backend/libpq/auth-oauth.c | 27 ++++++++++--------- .../modules/oauth_validator/t/001_server.pl | 18 +++++++++++++ 2 files changed, 32 insertions(+), 13 deletions(-) diff --git a/src/backend/libpq/auth-oauth.c b/src/backend/libpq/auth-oauth.c index b769931ca4f..fb830065fba 100644 --- a/src/backend/libpq/auth-oauth.c +++ b/src/backend/libpq/auth-oauth.c @@ -863,20 +863,8 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg) *err_msg = NULL; - if (oauth_validator_libraries_string[0] == '\0') - { - ereport(elevel, - errcode(ERRCODE_CONFIG_FILE_ERROR), - errmsg("parameter \"%s\" must be set for authentication method \"%s\"", - "oauth_validator_libraries", "oauth"), - errcontext("line %d of configuration file \"%s\"", - line_num, file_name)); - *err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"", - "oauth_validator_libraries", "oauth"); - return false; - } - /* SplitDirectoriesString needs a modifiable copy */ + Assert(oauth_validator_libraries_string != NULL); rawstring = pstrdup(oauth_validator_libraries_string); if (!SplitDirectoriesString(rawstring, ',', &elemlist)) @@ -891,6 +879,19 @@ check_oauth_validator(HbaLine *hbaline, int elevel, char **err_msg) goto done; } + if (elemlist == NIL) + { + ereport(elevel, + errcode(ERRCODE_CONFIG_FILE_ERROR), + errmsg("parameter \"%s\" must be set for authentication method \"%s\"", + "oauth_validator_libraries", "oauth"), + errcontext("line %d of configuration file \"%s\"", + line_num, file_name)); + *err_msg = psprintf("parameter \"%s\" must be set for authentication method \"%s\"", + "oauth_validator_libraries", "oauth"); + goto done; + } + if (!hbaline->oauth_validator) { if (elemlist->length == 1) diff --git a/src/test/modules/oauth_validator/t/001_server.pl b/src/test/modules/oauth_validator/t/001_server.pl index 8941a355423..fb76c69c1ca 100644 --- a/src/test/modules/oauth_validator/t/001_server.pl +++ b/src/test/modules/oauth_validator/t/001_server.pl @@ -134,6 +134,24 @@ is( $contents, 3|oauth|\{issuer=$issuer/param,"scope=openid postgres",validator=validator\}}, "pg_hba_file_rules recreates OAuth HBA settings"); +# An all-whitespace library list parses as an empty list. Reject it without +# crashing the postmaster during HBA reload. +$node->append_conf('postgresql.conf', "oauth_validator_libraries = ' '"); +$node->reload; +$log_start = $node->wait_for_log( + qr/parameter "oauth_validator_libraries" must be set for authentication/, + $log_start); +$bgconn->query_safe('SELECT 1'); + +$node->append_conf('postgresql.conf', + "oauth_validator_libraries = 'validator'"); +$node->reload; +$log_start = $node->wait_for_log( + qr/parameter "oauth_validator_libraries" changed to "validator"/, + $log_start); +is($bgconn->query_safe('SHOW oauth_validator_libraries'), + 'validator', 'oauth_validator_libraries restored'); + { # Make sure PGOAUTHDEBUG=UNSAFE doesn't disable certificate verification. local $ENV{PGOAUTHDEBUG} = "UNSAFE";