From 2860d322ae98dd3c1f8608fc02fb777dd51d41f2 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Tue, 18 Aug 2026 17:33:44 -0400 Subject: [PATCH] Defend against null "SV *" pointers in plperl modules. Tied hashes, and probably tied arrays, are capable of returning Perl value pointers that are actually NULL, not the usual pointer to an undef SV. We were not defending against that everywhere, leading to possible SIGSEGV. Fix the code to consistently treat a null pointer returned from hv_iternext or av_fetch like a !SvOK one. (Note that the large diff in SV_to_JsonbValue is actually quite trivial, but it required reindenting a chunk of existing code.) Claude Code found the instance in hstore_plperl, and I found the others by code auditing. Perhaps the other instances aren't actually reachable, but I see little reason to assume that. The known test cases for these errors require perl's Tie modules, which may not be present, so it doesn't seem worth the trouble to create regression test cases that would cover them. Reported-by: Claude Code (via Noah Misch) Author: Tom Lane Discussion: https://postgr.es/m/569769.1786901901@sss.pgh.pa.us Backpatch-through: 14 --- contrib/hstore_plperl/hstore_plperl.c | 2 +- contrib/jsonb_plperl/jsonb_plperl.c | 151 ++++++++++++++------------ src/pl/plperl/plperl.c | 2 +- 3 files changed, 81 insertions(+), 74 deletions(-) diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c index 4977724a1bf..09d1cbaa8ac 100644 --- a/contrib/hstore_plperl/hstore_plperl.c +++ b/contrib/hstore_plperl/hstore_plperl.c @@ -146,7 +146,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS) pairs[i].keylen = hstoreCheckKeyLen(strlen(pairs[i].key)); pairs[i].needfree = true; - if (!SvOK(value)) + if (!value || !SvOK(value)) { pairs[i].val = NULL; pairs[i].vallen = 0; diff --git a/contrib/jsonb_plperl/jsonb_plperl.c b/contrib/jsonb_plperl/jsonb_plperl.c index bace1f0c890..e75ad4a0010 100644 --- a/contrib/jsonb_plperl/jsonb_plperl.c +++ b/contrib/jsonb_plperl/jsonb_plperl.c @@ -183,7 +183,7 @@ SV_to_JsonbValue(SV *in, JsonbParseState **jsonb_state, bool is_elem) check_stack_depth(); /* Dereference references recursively. */ - while (SvROK(in)) + while (in && SvROK(in)) { /* * It's possible for circular references to make this an infinite @@ -194,84 +194,91 @@ SV_to_JsonbValue(SV *in, JsonbParseState **jsonb_state, bool is_elem) in = SvRV(in); } - switch (SvTYPE(in)) + if (!in) { - case SVt_PVAV: - return AV_to_JsonbValue((AV *) in, jsonb_state); + out.type = jbvNull; + } + else + { + switch (SvTYPE(in)) + { + case SVt_PVAV: + return AV_to_JsonbValue((AV *) in, jsonb_state); - case SVt_PVHV: - return HV_to_JsonbValue((HV *) in, jsonb_state); + case SVt_PVHV: + return HV_to_JsonbValue((HV *) in, jsonb_state); - default: - if (!SvOK(in)) - { - out.type = jbvNull; - } - else if (SvUOK(in)) - { - /* - * If UV is >=64 bits, we have no better way to make this - * happen than converting to text and back. Given the low - * usage of UV in Perl code, it's not clear it's worth working - * hard to provide alternate code paths. - */ - const char *strval = SvPV_nolen(in); + default: + if (!SvOK(in)) + { + out.type = jbvNull; + } + else if (SvUOK(in)) + { + /* + * If UV is >=64 bits, we have no better way to make this + * happen than converting to text and back. Given the low + * usage of UV in Perl code, it's not clear it's worth + * working hard to provide alternate code paths. + */ + const char *strval = SvPV_nolen(in); - out.type = jbvNumeric; - out.val.numeric = - DatumGetNumeric(DirectFunctionCall3(numeric_in, - CStringGetDatum(strval), - ObjectIdGetDatum(InvalidOid), - Int32GetDatum(-1))); - } - else if (SvIOK(in)) - { - IV ival = SvIV(in); + out.type = jbvNumeric; + out.val.numeric = + DatumGetNumeric(DirectFunctionCall3(numeric_in, + CStringGetDatum(strval), + ObjectIdGetDatum(InvalidOid), + Int32GetDatum(-1))); + } + else if (SvIOK(in)) + { + IV ival = SvIV(in); - out.type = jbvNumeric; - out.val.numeric = int64_to_numeric(ival); - } - else if (SvNOK(in)) - { - double nval = SvNV(in); + out.type = jbvNumeric; + out.val.numeric = int64_to_numeric(ival); + } + else if (SvNOK(in)) + { + double nval = SvNV(in); - /* - * jsonb doesn't allow infinity or NaN (per JSON - * specification), but the numeric type that is used for the - * storage accepts those, so we have to reject them here - * explicitly. - */ - if (isinf(nval)) + /* + * jsonb doesn't allow infinity or NaN (per JSON + * specification), but the numeric type that is used for + * the storage accepts those, so we have to reject them + * here explicitly. + */ + if (isinf(nval)) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("cannot convert infinity to jsonb"))); + if (isnan(nval)) + ereport(ERROR, + (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), + errmsg("cannot convert NaN to jsonb"))); + + out.type = jbvNumeric; + out.val.numeric = + DatumGetNumeric(DirectFunctionCall1(float8_numeric, + Float8GetDatum(nval))); + } + else if (SvPOK(in)) + { + out.type = jbvString; + out.val.string.val = sv2cstr(in); + out.val.string.len = strlen(out.val.string.val); + } + else + { + /* + * XXX It might be nice if we could include the Perl type + * in the error message. + */ ereport(ERROR, - (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), - errmsg("cannot convert infinity to jsonb"))); - if (isnan(nval)) - ereport(ERROR, - (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE), - errmsg("cannot convert NaN to jsonb"))); - - out.type = jbvNumeric; - out.val.numeric = - DatumGetNumeric(DirectFunctionCall1(float8_numeric, - Float8GetDatum(nval))); - } - else if (SvPOK(in)) - { - out.type = jbvString; - out.val.string.val = sv2cstr(in); - out.val.string.len = strlen(out.val.string.val); - } - else - { - /* - * XXX It might be nice if we could include the Perl type in - * the error message. - */ - ereport(ERROR, - (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), - errmsg("cannot transform this Perl type to jsonb"))); - return NULL; - } + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("cannot transform this Perl type to jsonb"))); + return NULL; + } + } } /* Push result into 'jsonb_state' unless it is a raw scalar. */ diff --git a/src/pl/plperl/plperl.c b/src/pl/plperl/plperl.c index e4c385f76b0..0fe36c17ff1 100644 --- a/src/pl/plperl/plperl.c +++ b/src/pl/plperl/plperl.c @@ -1140,7 +1140,7 @@ get_perl_array_ref(SV *sv) { dTHX; - if (SvOK(sv) && SvROK(sv)) + if (sv && SvOK(sv) && SvROK(sv)) { if (SvTYPE(SvRV(sv)) == SVt_PVAV) return sv;