Hi! Using the Svace static analyzer I found what appears to be a real security vulnerability in your project. Could you please take a look?
Severity: Critical
Analyzer: Svace
DEREF_AFTER_NULL — /src/bin/polar_tools/control_data_change.c:73
After having been compared to a NULL value at control_data_change.c:66, pointer 'fp' is dereferenced at control_data_change.c:73 by calling function 'fclose'.
DEREF_OF_NULL.EX — /src/backend/parser/analyze.c:1639
After having been assigned to a NULL value at analyze.c:1483, pointer 'exprsLists' is passed as 2nd parameter in call to function 'addRangeTableEntryForValues' at analyze.c:1639, where it is dereferenced at parse_relation.c:2163.
DEREF_OF_NULL.EX — `/src/backend/parser/parse_func.c:600
After having been assigned to a NULL value at parse_func.c:112, pointer 'first_arg' is passed as 3rd parameter in call to function 'ParseComplexProjection' at parse_func.c:600, where it is dereferenced at parse_func.c:1934.
DEREF_OF_NULL.EX — /src/backend/utils/adt/jsonb_gin.c:1155
After having been assigned to a NULL value at jsonb_gin.c:1113, pointer 'stack->parent' is dereferenced at jsonb_gin.c:1155.
DEREF_OF_NULL.EX — `/src/backend/utils/adt/jsonfuncs.c:5287
After having been assigned to a NULL value at jsonfuncs.c:5266, pointer 'pathelem' is dereferenced at jsonfuncs.c:5287.
DEREF_OF_NULL.EX — /src/backend/utils/adt/ruleutils.c
3 occurrences of this issue in the file:
Line 1878
After having been assigned to a NULL value at ruleutils.c:1829, pointer 'astate' is passed as 1st parameter in call to function 'makeArrayResult' at ruleutils.c:1878, where it is dereferenced at arrayfuncs.c:5422.
Line 3380
After having been assigned to a NULL value at ruleutils.c:3264, pointer 'argdefaults' is passed as 1st parameter in call to function 'lnext' at ruleutils.c:3380, where it is dereferenced at pg_list.h:347.
Line 11569
After having been assigned to a NULL value at ruleutils.c:11494, pointer 'opname' is dereferenced at ruleutils.c:11569 by calling function 'strcmp'.
DEREF_OF_NULL.EX — /src/bin/pg_dump/pg_dump.c:13957
After having been assigned to a NULL value at pg_dump.c:13944, pointer '&collcollate[0]' is dereferenced at pg_dump.c:13957.
DEREF_OF_NULL.EX — /src/bin/polar_tools/control_data_change.c:108
After having been assigned to a NULL value at control_data_change.c:96, pointer 'data' is dereferenced at control_data_change.c:108.
DEREF_OF_NULL.EX — /src/bin/polar_tools/logindex_page_dump.c:162
After having been assigned to a NULL value at logindex_page_dump.c:116, pointer 'table_path' is dereferenced at logindex_page_dump.c:162 by calling function 'fopen'.
DEREF_OF_NULL.EX — /src/pl/plperl/plperl.c:2218
After having been assigned to a NULL value at plperl.c:2187, pointer '&argtypes[i]' is dereferenced at plperl.c:2218.
OVERFLOW_AFTER_CHECK.EX — /src/tools/pg_bsd_indent/parse.c
2 occurrences of this issue in the file:
Line 209
Expression is used as an index for accessing an array's element in function 'reduce' at parse.c:209. This expression can have value 159, which is out of range, as indicated by a preceding conditional expression at parse.c:206.
Line 209
Expression is used as an index for accessing an array's element in function 'reduce' at parse.c:209. This expression can have value 191, which is out of range, as indicated by a preceding conditional expression at parse.c:206.
OVERFLOW_UNDER_CHECK — /external/pg_cron/src/misc.c:94
Accessing an element of array 'file->unget_data' of size 1000 at misc.c:94 can lead to a buffer overflow, since the index 'buffer->unget_count' can have an out of range value 1023, as indicated by a preceding conditional expression at misc.c:88.
TAINTED_INT.LOOP.MIGHT — /src/backend/utils/adt/jsonfuncs.c:5557
Integer value 'idx - nelems' obtained from untrusted source at string.c:55 by calling function 'strtol' without checking its bounds is used as a loop bound at jsonfuncs.c:1706 by passing as 2nd parameter to function 'push_null_elements' at jsonfuncs.c:5557.
TAINTED_PTR — /src/bin/pg_combinebackup/pg_combinebackup.c
2 occurrences of this issue in the file:
Line 310
Variable 'last_input_dir' is obtained from an untrusted source at pg_combinebackup.c:309. The variable is used in a vulnerable operation at pg_combinebackup.c:675 by passing as 1st parameter to function 'check_input_dir_permissions' at pg_combinebackup.c:310. Please double check if input string is properly validated in error-prone manner
Line 675
Variable 'dir' is obtained from an untrusted source at pg_combinebackup.c:671. The variable is used in a vulnerable operation at pg_combinebackup.c:675 by calling function 'stat'. Please double check if input string is properly validated in error-prone manner
TAINTED_PTR — /src/interfaces/libpq/fe-protocol3.c:2369
String variable 'val' is obtained from an untrusted source at fe-protocol3.c:2366 by calling function 'getenv' and has its content copied to another string at fe-protocol3.c:2369 by calling function 'strcpy'. This may lead to unexpected behavior because length of the string from untrusted source is unknown.
Hi! Using the Svace static analyzer I found what appears to be a real security vulnerability in your project. Could you please take a look?
Severity: Critical
Analyzer: Svace
DEREF_AFTER_NULL—/src/bin/polar_tools/control_data_change.c:73After having been compared to a NULL value at control_data_change.c:66, pointer 'fp' is dereferenced at control_data_change.c:73 by calling function 'fclose'.
DEREF_OF_NULL.EX—/src/backend/parser/analyze.c:1639After having been assigned to a NULL value at analyze.c:1483, pointer 'exprsLists' is passed as 2nd parameter in call to function 'addRangeTableEntryForValues' at analyze.c:1639, where it is dereferenced at parse_relation.c:2163.
DEREF_OF_NULL.EX— `/src/backend/parser/parse_func.c:600After having been assigned to a NULL value at parse_func.c:112, pointer 'first_arg' is passed as 3rd parameter in call to function 'ParseComplexProjection' at parse_func.c:600, where it is dereferenced at parse_func.c:1934.
DEREF_OF_NULL.EX—/src/backend/utils/adt/jsonb_gin.c:1155After having been assigned to a NULL value at jsonb_gin.c:1113, pointer 'stack->parent' is dereferenced at jsonb_gin.c:1155.
DEREF_OF_NULL.EX— `/src/backend/utils/adt/jsonfuncs.c:5287After having been assigned to a NULL value at jsonfuncs.c:5266, pointer 'pathelem' is dereferenced at jsonfuncs.c:5287.
DEREF_OF_NULL.EX—/src/backend/utils/adt/ruleutils.c3 occurrences of this issue in the file:
Line 1878
After having been assigned to a NULL value at ruleutils.c:1829, pointer 'astate' is passed as 1st parameter in call to function 'makeArrayResult' at ruleutils.c:1878, where it is dereferenced at arrayfuncs.c:5422.
Line 3380
After having been assigned to a NULL value at ruleutils.c:3264, pointer 'argdefaults' is passed as 1st parameter in call to function 'lnext' at ruleutils.c:3380, where it is dereferenced at pg_list.h:347.
Line 11569
After having been assigned to a NULL value at ruleutils.c:11494, pointer 'opname' is dereferenced at ruleutils.c:11569 by calling function 'strcmp'.
DEREF_OF_NULL.EX—/src/bin/pg_dump/pg_dump.c:13957After having been assigned to a NULL value at pg_dump.c:13944, pointer '&collcollate[0]' is dereferenced at pg_dump.c:13957.
DEREF_OF_NULL.EX—/src/bin/polar_tools/control_data_change.c:108After having been assigned to a NULL value at control_data_change.c:96, pointer 'data' is dereferenced at control_data_change.c:108.
DEREF_OF_NULL.EX—/src/bin/polar_tools/logindex_page_dump.c:162After having been assigned to a NULL value at logindex_page_dump.c:116, pointer 'table_path' is dereferenced at logindex_page_dump.c:162 by calling function 'fopen'.
DEREF_OF_NULL.EX—/src/pl/plperl/plperl.c:2218After having been assigned to a NULL value at plperl.c:2187, pointer '&argtypes[i]' is dereferenced at plperl.c:2218.
OVERFLOW_AFTER_CHECK.EX—/src/tools/pg_bsd_indent/parse.c2 occurrences of this issue in the file:
Line 209
Expression is used as an index for accessing an array's element in function 'reduce' at parse.c:209. This expression can have value 159, which is out of range, as indicated by a preceding conditional expression at parse.c:206.
Line 209
Expression is used as an index for accessing an array's element in function 'reduce' at parse.c:209. This expression can have value 191, which is out of range, as indicated by a preceding conditional expression at parse.c:206.
OVERFLOW_UNDER_CHECK—/external/pg_cron/src/misc.c:94Accessing an element of array 'file->unget_data' of size 1000 at misc.c:94 can lead to a buffer overflow, since the index 'buffer->unget_count' can have an out of range value 1023, as indicated by a preceding conditional expression at misc.c:88.
TAINTED_INT.LOOP.MIGHT—/src/backend/utils/adt/jsonfuncs.c:5557Integer value 'idx - nelems' obtained from untrusted source at string.c:55 by calling function 'strtol' without checking its bounds is used as a loop bound at jsonfuncs.c:1706 by passing as 2nd parameter to function 'push_null_elements' at jsonfuncs.c:5557.
TAINTED_PTR—/src/bin/pg_combinebackup/pg_combinebackup.c2 occurrences of this issue in the file:
Line 310
Variable 'last_input_dir' is obtained from an untrusted source at pg_combinebackup.c:309. The variable is used in a vulnerable operation at pg_combinebackup.c:675 by passing as 1st parameter to function 'check_input_dir_permissions' at pg_combinebackup.c:310. Please double check if input string is properly validated in error-prone manner
Line 675
Variable 'dir' is obtained from an untrusted source at pg_combinebackup.c:671. The variable is used in a vulnerable operation at pg_combinebackup.c:675 by calling function 'stat'. Please double check if input string is properly validated in error-prone manner
TAINTED_PTR—/src/interfaces/libpq/fe-protocol3.c:2369String variable 'val' is obtained from an untrusted source at fe-protocol3.c:2366 by calling function 'getenv' and has its content copied to another string at fe-protocol3.c:2369 by calling function 'strcpy'. This may lead to unexpected behavior because length of the string from untrusted source is unknown.