From fd7e11b92b3a5b94abc11228d41b5f83acd92773 Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Tue, 6 Oct 2026 13:28:00 +0200 Subject: [PATCH] Copy SSL GUCs into the hosts context When the SSL configuration from postgresql.conf is used, the default host entry stored pointers to the relevant GUC variables. These pointers are not guaranteed to survive a failed configuration reload so copy the values into the hosts memory context. Author: Zsolt Parragi Reviewed-by: Daniel Gustafsson Reviewed-by: Rui Zhao Discussion: https://postgr.es/m/A1745424-7110-41E9-B98C-3CED1A034A8F@yesql.se Backpatch-through: 19 --- src/backend/libpq/be-secure-openssl.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index ba7798e50de..810a66bbda5 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -346,10 +346,14 @@ be_tls_init(bool isServerStart) Assert(ssl_sni == false); #endif - pgconf->ssl_cert = ssl_cert_file; - pgconf->ssl_key = ssl_key_file; - pgconf->ssl_ca = ssl_ca_file; - pgconf->ssl_passphrase_cmd = ssl_passphrase_command; + /* + * Copy the configuration from the GUC variables since they aren't + * guaranteed to survive a failed reload. + */ + pgconf->ssl_cert = pstrdup(ssl_cert_file); + pgconf->ssl_key = pstrdup(ssl_key_file); + pgconf->ssl_ca = pstrdup(ssl_ca_file); + pgconf->ssl_passphrase_cmd = pstrdup(ssl_passphrase_command); pgconf->ssl_passphrase_reload = ssl_passphrase_command_supports_reload; if (!init_host_context(pgconf, isServerStart, &hasWarned))