psql: fix startup crash caused by PSQLRC containing a tilde

bmomjian · bmomjian · commit 48a2cd370e26 · 2013-04-04T12:56:24.000-04:00
'strdup' the PSQLRC environment variable value before calling a routine
that might free() it.

Backpatch to 9.2, where the bug first appeared.
diff --git a/src/bin/psql/common.c b/src/bin/psql/common.c
@@ -1645,11 +1645,11 @@ session_username(void)
  * substitute '~' with HOME or '~username' with username's home dir
  *
  */
-char *
+void
 expand_tilde(char **filename)
 {
 	if (!filename || !(*filename))
-		return NULL;
+		return;
 
 	/*
 	 * WIN32 doesn't use tilde expansion for file names. Also, it uses tilde
@@ -1697,5 +1697,5 @@ expand_tilde(char **filename)
 	}
 #endif
 
-	return *filename;
+	return;
 }
diff --git a/src/bin/psql/common.h b/src/bin/psql/common.h
@@ -44,6 +44,6 @@ extern bool is_superuser(void);
 extern bool standard_strings(void);
 extern const char *session_username(void);
 
-extern char *expand_tilde(char **filename);
+extern void expand_tilde(char **filename);
 
 #endif   /* COMMON_H */
diff --git a/src/bin/psql/startup.c b/src/bin/psql/startup.c
@@ -610,20 +610,21 @@ process_psqlrc(char *argv0)
 	char		rc_file[MAXPGPATH];
 	char		my_exec_path[MAXPGPATH];
 	char		etc_path[MAXPGPATH];
-	char	   *envrc;
+	char	   *envrc = getenv("PSQLRC");
 
 	find_my_exec(argv0, my_exec_path);
 	get_etc_path(my_exec_path, etc_path);
 
 	snprintf(rc_file, MAXPGPATH, "%s/%s", etc_path, SYSPSQLRC);
 	process_psqlrc_file(rc_file);
 
-	envrc = getenv("PSQLRC");
-
 	if (envrc != NULL && strlen(envrc) > 0)
 	{
-		expand_tilde(&envrc);
-		process_psqlrc_file(envrc);
+		/* might need to free() this */
+		char *envrc_alloc = pstrdup(envrc);
+
+		expand_tilde(&envrc_alloc);
+		process_psqlrc_file(envrc_alloc);
 	}
 	else if (get_home_path(home))
 	{

Original file line number	Diff line number	Diff line change
`@@ -1645,11 +1645,11 @@ session_username(void)`
`1645`	`1645`	`* substitute '~' with HOME or '~username' with username's home dir`
`1646`	`1646`	`*`
`1647`	`1647`	`*/`
`1648`		`-char *`
	`1648`	`+void`
`1649`	`1649`	`expand_tilde(char **filename)`
`1650`	`1650`	`{`
`1651`	`1651`	`if (!filename \|\| !(*filename))`
`1652`		`- return NULL;`
	`1652`	`+ return;`
`1653`	`1653`
`1654`	`1654`	`/*`
`1655`	`1655`	`* WIN32 doesn't use tilde expansion for file names. Also, it uses tilde`
`@@ -1697,5 +1697,5 @@ expand_tilde(char **filename)`
`1697`	`1697`	`}`
`1698`	`1698`	`#endif`
`1699`	`1699`
`1700`		`- return *filename;`
	`1700`	`+ return;`
`1701`	`1701`	`}`