Noted with versions 7.0.3, 7.1.3, and 7.2.1:

bmomjian · bmomjian · commit cd7be4d9470c · 2002-06-15T19:37:48.000Z
The psql interpreter becomes unstable if variable substitutions
are used.  The debugger GDB was unable to help however mpatrol
reports that the sprintf at mainloop.c:389 is steping one byte
farther than the allocation.

William K. Volkman
diff --git a/src/bin/psql/mainloop.c b/src/bin/psql/mainloop.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2000 by PostgreSQL Global Development Group
  *
- * $Header: /cvsroot/pgsql/src/bin/psql/mainloop.c,v 1.47 2002/03/27 19:16:13 petere Exp $
+ * $Header: /cvsroot/pgsql/src/bin/psql/mainloop.c,v 1.48 2002/06/15 19:37:48 momjian Exp $
  */
 #include "postgres_fe.h"
 #include "mainloop.h"
@@ -378,7 +378,8 @@ MainLoop(FILE *source)
 				{
 					out_length = strlen(value);
 
-					new = malloc(len + out_length - (1 + in_length) + 1);
+					/* Allow for 'after' character also 2002-05-27 */
+					new = malloc(len + out_length - (1 + in_length) + 1 + 1);
 					if (!new)
 					{
 						psql_error("out of memory\n");

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@`
`3`	`3`	`*`
`4`	`4`	`* Copyright 2000 by PostgreSQL Global Development Group`
`5`	`5`	`*`
`6`		`- * $Header: /cvsroot/pgsql/src/bin/psql/mainloop.c,v 1.47 2002/03/27 19:16:13 petere Exp $`
	`6`	`+ * $Header: /cvsroot/pgsql/src/bin/psql/mainloop.c,v 1.48 2002/06/15 19:37:48 momjian Exp $`
`7`	`7`	`*/`
`8`	`8`	`#include "postgres_fe.h"`
`9`	`9`	`#include "mainloop.h"`
`@@ -378,7 +378,8 @@ MainLoop(FILE *source)`
`378`	`378`	`{`
`379`	`379`	`out_length = strlen(value);`
`380`	`380`
`381`		`- new = malloc(len + out_length - (1 + in_length) + 1);`
	`381`	`+ /* Allow for 'after' character also 2002-05-27 */`
	`382`	`+ new = malloc(len + out_length - (1 + in_length) + 1 + 1);`
`382`	`383`	`if (!new)`
`383`	`384`	`{`
`384`	`385`	`psql_error("out of memory\n");`