Bug Report
IvorySQL Version
master at c3529ba4789ee220caefc858e58bbe6f1563ad14
Current Behavior
src/backend/executor/execExprInterp.c (IS_UPDATEXML case, lines 4741-4752):
-
NULL arguments crash (high): the argument list is built with DatumGetPointer(argvalue[i]) without checking op->d.xmlexpr.argnull[i]. A NULL argument (NULL column or NULL subexpression) leaves argvalue[i] as uninitialized garbage, and the updatexml() hook dereferences it — backend crash. The sibling IS_XMLSERIALIZE / IS_DOCUMENT cases check argnull[0] first.
-
Missing-hook fallback returns a non-null Datum 0 (medium): when ora_updatexml_hook is NULL (extension not loaded / stale plan), the else branch sets *op->resvalue = (Datum) 0; *op->resnull = false; — a "non-null" zero Datum that downstream code treats as a valid text pointer.
Expected behavior/code
- Skip (return with
resnull already true) when any argument is NULL
else { *op->resnull = true; }
Bug Report
IvorySQL Version
masteratc3529ba4789ee220caefc858e58bbe6f1563ad14Current Behavior
src/backend/executor/execExprInterp.c(IS_UPDATEXML case, lines 4741-4752):NULL arguments crash (high): the argument list is built with
DatumGetPointer(argvalue[i])without checkingop->d.xmlexpr.argnull[i]. A NULL argument (NULL column or NULL subexpression) leavesargvalue[i]as uninitialized garbage, and theupdatexml()hook dereferences it — backend crash. The sibling IS_XMLSERIALIZE / IS_DOCUMENT cases checkargnull[0]first.Missing-hook fallback returns a non-null Datum 0 (medium): when
ora_updatexml_hookis NULL (extension not loaded / stale plan), the else branch sets*op->resvalue = (Datum) 0; *op->resnull = false;— a "non-null" zero Datum that downstream code treats as a valid text pointer.Expected behavior/code
resnullalready true) when any argument is NULLelse { *op->resnull = true; }