Re: BUG #18943: Return value of a function 'xmlBufferCreate' is dereferenced at xpath.c:177 without checking for NUL

On Wed Jul 9, 2025 at 03:45:07 GMT +03, Michael Paquier wrote:
> Yes, I don't see a huge advantage in doing the switch for this module.
> If the gain in information in the error states grabbed from libxml2
> makes it a win, that may be a different argument (I am fine to be
> proved wrong), but I cannot get excited about that without more
> data to claim it so.
>
Once switching to PG_XML_STRICTNESS_ALL, we should also theoretically
be able to receive warnings and notices, that would be silent otherwise.
I believe that getting rid of PG_XML_STRICTNESS_LEGACY might also be
desirable if we ever want to get xml2 into core.

But I notice that you did already change lots of PG_XML_STRICTNESS_LEGACY
into PG_XML_STRICTNESS_ALL.

> I have quickly tested the change, and the xpath_string() path was one
> area that immediately stood out, and we may report an incorrect error.

You are right. The test suite fails or hangs at least. We are probably
still missing some checks. So it wouldn't just be a matter of
replacing all remaining PG_XML_STRICTNESS_LEGACY.

--
Robin Haberkorn
Software Engineer

B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / https://www.b1-systems.de
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt, HRB 3537