• Tom Lane's avatar
    Be more paranoid about null return values from libpq status functions. · c5ef8ce5
    Tom Lane authored
    PQhost() can return NULL in non-error situations, namely when a Unix-socket
    connection has been selected by default.  That behavior is a tad debatable
    perhaps, but for the moment we should make sure that psql copes with it.
    Unfortunately, do_connect() failed to: it could pass a NULL pointer to
    strcmp(), resulting in crashes on most platforms.  This was reported as a
    security issue by ChenQin of Topsec Security Team, but the consensus of
    the security list is that it's just a garden-variety bug with no security
    implications.
    
    For paranoia's sake, I made the keep_password test not trust PQuser or
    PQport either, even though I believe those will never return NULL given
    a valid PGconn.
    
    Back-patch to all supported branches.
    c5ef8ce5
command.c 81.1 KB