Guard time bucket parameter handling against bad input

Reading the time bucket parameters of a continuous aggregate could
read from a NULL pointer when the timezone or offset argument was a
NULL constant, and could read past the end of the argument list when
the function had fewer than two arguments. Skip the read when the
constant is NULL, and check the number of arguments before accessing
them.

Author: svenklemm

.unreleased/pr_9708

@@ -0,0 +1 @@
+Fixes: #9708 Guard time bucket parameter handling against bad input

tsl/src/continuous_aggs/common.c

@@ -188,19 +188,25 @@ process_additional_timebucket_parameter(ContinuousAggBucketFunction *bf, Const *
 	{
 		/* Timezone as text */
 		case TEXTOID:
-			tz_name = TextDatumGetCString(arg->constvalue);
-			if (!ts_is_valid_timezone_name(tz_name))
+			if (!arg->constisnull)
 			{
-				ereport(ERROR,
-						(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-						 errmsg("invalid timezone name \"%s\"", tz_name)));
-			}
+				tz_name = TextDatumGetCString(arg->constvalue);
+				if (!ts_is_valid_timezone_name(tz_name))
+				{
+					ereport(ERROR,
+							(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+							 errmsg("invalid timezone name \"%s\"", tz_name)));
+				}
 
-			bf->bucket_time_timezone = tz_name;
+				bf->bucket_time_timezone = tz_name;
+			}
 			break;
 		case INTERVALOID:
 			/* Bucket offset as interval */
-			bf->bucket_time_offset = DatumGetIntervalP(arg->constvalue);
+			if (!arg->constisnull)
+			{
+				bf->bucket_time_offset = DatumGetIntervalP(arg->constvalue);
+			}
 			break;
 		case DATEOID:
 			/* Bucket origin as Date */
@@ -258,6 +264,14 @@ process_timebucket_parameters(FuncExpr *fe, ContinuousAggBucketFunction *bf, boo
 	TIMESTAMP_NOBEGIN(bf->bucket_time_origin);
 	int nargs;
 
+	nargs = list_length(fe->args);
+	if (nargs < 2 || nargs > 5)
+	{
+		ereport(ERROR,
+				(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+				 errmsg("unsupported time bucket function signature")));
+	}
+
 	/* Only column allowed : time_bucket('1day', <column> ) */
 	col_arg = lsecond(fe->args);
 
@@ -286,9 +300,6 @@ process_timebucket_parameters(FuncExpr *fe, ContinuousAggBucketFunction *bf, boo
 		return;
 	}
 
-	nargs = list_length(fe->args);
-	Assert(nargs >= 2 && nargs <= 5);
-
 	/*
 	 * Process the third argument of the time bucket function. This could be `timezone`, `offset`,
 	 * or `origin`.