Correctly copy the target host identification in PQcancelCreate.

tglsfdc · tglsfdc · commit 5d0800000ed5 · 2025-07-02T15:48:03.000-04:00
PQcancelCreate failed to copy struct pg_conn_host's "type" field, instead leaving it zero (a/k/a CHT_HOST_NAME). This seemingly has no great ill effects if it should have been CHT_UNIX_SOCKET instead, but if it should have been CHT_HOST_ADDRESS then a null-pointer dereference will occur when the cancelConn is used. Bug: #18974 Reported-by: Maxim Boguk <maxim.boguk@gmail.com> Author: Sergei Kornilov <sk@zsrv.org> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Discussion: https://postgr.es/m/18974-575f02b2168b36b3@postgresql.org Backpatch-through: 17
diff --git a/src/interfaces/libpq/fe-cancel.c b/src/interfaces/libpq/fe-cancel.c
@@ -137,6 +137,7 @@ PQcancelCreate(PGconn *conn)
 		goto oom_error;
 
 	originalHost = conn->connhost[conn->whichhost];
+	cancelConn->connhost[0].type = originalHost.type;
 	if (originalHost.host)
 	{
 		cancelConn->connhost[0].host = strdup(originalHost.host);

Original file line number	Diff line number	Diff line change
`@@ -137,6 +137,7 @@ PQcancelCreate(PGconn *conn)`
`137`	`137`	`goto oom_error;`
`138`	`138`
`139`	`139`	`originalHost = conn->connhost[conn->whichhost];`
	`140`	`+ cancelConn->connhost[0].type = originalHost.type;`
`140`	`141`	`if (originalHost.host)`
`141`	`142`	`{`
`142`	`143`	`cancelConn->connhost[0].host = strdup(originalHost.host);`