supabase / supautils / 29598237239

91%

push

github

fix: segfault on GRANT/REVOKE role with current_user/session_user/public grantee (#205)

* fix: segfault on GRANT/REVOKE role with current_user/session_user/public grantee

The T_GrantRoleStmt handler cast stmt->grantee_roles cells to AccessPriv,
but the grammar builds that list from role_list, which produces RoleSpec
nodes. The two structs happen to place priv_name and rolename at the same
offset, so named grantees accidentally worked; for special role specs
(CURRENT_USER, CURRENT_ROLE, SESSION_USER, PUBLIC) rolename is NULL and
is_reserved_role crashed on strcmp(NULL, ...).

Resolve grantees with get_rolespec_name like the ALTER ROLE paths do. This
also closes the gap where a reserved role could grant to itself via
current_user, and makes GRANT ... TO public error identically to vanilla
Postgres.

Also replace all remaining raw casts of list cells holding parse nodes
with lfirst_node so the cassert builds used in CI verify node types.

Reported in SU-419080.

* chore: format

13 of 13 new or added lines in 3 files covered. (100.0%)

1152 of 1270 relevant lines covered (90.71%)

50.18 hits per line