Skip to content

Commit 551ac36

Browse files
committed
Add NULL guards for exec_state_call_stack in pl_exec.c and pl_exec-2.c
Three remaining crash sites after commit 3b06bdd (which covered iterative_exec.c) still dereference exec_state_call_stack without a NULL check: 1. pl_exec.c:1283 (pltsql_exec_trigger): pltsql_exec_trigger never pushes exec_state_call_stack -- only pltsql_exec_function does at line 4475. When a trigger fires from a pure SQL DML context with no outer PL/tsql function, exec_state_call_stack is NULL. Add NULL check before the trigger_error field dereference. 2. pl_exec.c:10301 (pltsql_estate_cleanup): INSERT EXEC cleanup paths can call this function with an empty stack. Add early return when exec_state_call_stack is NULL to prevent crash on ->next dereference. 3. pl_exec-2.c:3365 (exec_stmt_usedb): The loop traverses the call stack looking for EXEC_BATCH to suppress the database context change notification. Guard the initial ->next access with a ternary; a NULL stack means no EXEC_BATCH above us, so fall through normally to send the notification (do NOT return early here). Also revert proc_ownership_chaining-vu-verify.out: accepting a permission denied error for EXEC p6030_8_3c is a regression. The CTE rewrite SPI call runs under the caller's security context rather than the procedure owner's, breaking ownership chaining for INSERT EXEC. Root-cause fix (security context switching in exec_stmt_execsql) will follow as a separate commit.
1 parent 3b06bdd commit 551ac36

File tree

3 files changed

+7
-6
lines changed

3 files changed

+7
-6
lines changed

contrib/babelfishpg_tsql/src/pl_exec-2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3362,7 +3362,7 @@ exec_stmt_usedb(PLtsql_execstate *estate, PLtsql_stmt_usedb *stmt)
33623362

33633363
set_cur_user_db_and_path(stmt->db_name, false);
33643364

3365-
top_es_entry = exec_state_call_stack->next;
3365+
top_es_entry = (exec_state_call_stack != NULL) ? exec_state_call_stack->next : NULL;
33663366
while (top_es_entry != NULL)
33673367
{
33683368
/*

contrib/babelfishpg_tsql/src/pl_exec.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1280,7 +1280,9 @@ pltsql_exec_trigger(PLtsql_function *func,
12801280
/*
12811281
* If an error was encountered when executing trigger.
12821282
*/
1283-
if (support_tsql_trans && !pltsql_disable_txn_in_triggers && exec_state_call_stack->error_data.trigger_error)
1283+
if (support_tsql_trans && !pltsql_disable_txn_in_triggers &&
1284+
exec_state_call_stack != NULL &&
1285+
exec_state_call_stack->error_data.trigger_error)
12841286
ereport(ERROR,
12851287
(errcode(ERRCODE_TRIGGERED_ACTION_EXCEPTION),
12861288
errmsg("An error was raised during trigger execution. The batch has been aborted and the user transaction, if any, has been rolled back.")));
@@ -10298,6 +10300,9 @@ pltsql_estate_cleanup(void)
1029810300
{
1029910301
PLExecStateCallStack *top_es_entry;
1030010302

10303+
if (exec_state_call_stack == NULL)
10304+
return;
10305+
1030110306
top_es_entry = exec_state_call_stack->next;
1030210307
if (top_es_entry != NULL)
1030310308
pltsql_copy_exec_error_data(&(exec_state_call_stack->error_data),

test/JDBC/expected/proc_ownership_chaining-vu-verify.out

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,6 @@ int
2727

2828
EXEC p6030_8_3c;
2929
GO
30-
~~ERROR (Code: 33557097)~~
31-
32-
~~ERROR (Message: permission denied for table t6030_22)~~
33-
3430

3531
-- CASE 8.4: Function referring table (success: function->table chain)
3632
SELECT * FROM f6030_8_4();

0 commit comments

Comments
 (0)