In src/oracle_fe_utils/ora_psqlscan.l around lines 1458 to 1468, the TODO notes
a potential memory leak with the psqlpluscmd pointer. Implement a dedicated
function that checks if psqlpluscmd is non-NULL, frees its allocated memory, and
sets it to NULL. Then, replace direct NULL assignments with calls to this
function and ensure it is invoked during cleanup in ora_psql_scan_finish to
properly manage memory and avoid leaks.

In src/bin/psql/mainloop.c around lines 560 to 588, the code modifies the token
string in place by inserting a null terminator, which alters the shared buffer
pstate->scanline used later for history and error reporting. To fix this, copy
the token string into a separate scratch buffer before performing any truncation
or modification, ensuring the original scanline buffer remains unchanged for
downstream consumers.

In src/bin/psql/mainloop.c around lines 453 to 460, the variable
psqlplus_callbacks is used but not declared, causing a compile-time error. To
fix this, declare and properly initialize a variable of type
Ora_psqlscan_callbacks named psqlplus_callbacks before passing it to
ora_psql_scan_create(). Ensure the declaration matches the expected structure
and is visible in this scope. Also, verify no other references to
psqlplus_callbacks exist elsewhere in the code.

In src/bin/psql/mainloop.c around lines 512 to 527, the code dereferences
bind_var->vartype without checking if it is NULL, which can cause a crash for
assignments without a type. Add a check to ensure bind_var->vartype is not NULL
before dereferencing it; if it is NULL, emit the same "Invalid option" error
message used elsewhere and avoid dereferencing to prevent null pointer crashes.

In src/bin/psql/mainloop.c around lines 434 to 457, the current condition
restricts the SQL*Plus scanner to only run on the first input line
(pset.stmt_lineno == 1), which causes multi-line SQL*Plus commands with
continuation characters to be misparsed. To fix this, remove or relax the
pset.stmt_lineno == 1 check so that the SQL*Plus scanner is invoked on every
input line once ORAPSCAN_EOL is reached, ensuring all continuation lines are
correctly parsed. Alternatively, implement a lexer flag indicating when input is
definitely not SQL*Plus and skip scanning only in those cases, preserving
performance without breaking multi-line command handling.

In src/bin/psql/psqlplusparse.y around lines 474 to 495, the function
get_guc_settings does not check if PQexec returns NULL, which can happen on
errors like OOM or lost connection. To fix this, add a check immediately after
PQexec to verify that res is not NULL before calling PQresultStatus or PQclear.
If res is NULL, handle the error appropriately (e.g., return NULL) while still
ensuring PQclear is called only when res is non-NULL.

In src/bin/psql/psqlplusparse.y around lines 531 to 538, the function merges
list2's items into list1 but does not free the memory allocated for list2->items
or list2 itself, causing a memory leak. After appending all items from list2 to
list1, add code to free the memory of list2->items and then free list2 to
properly release the allocated memory and prevent leaks.

In src/bin/psql/variables.c around lines 54 to 66, the function
valid_bind_variable_value allocates the query buffer before checking if value is
NULL and returns early without freeing the allocated query, causing a memory
leak. To fix this, free the query buffer before the early return when value is
NULL to ensure no memory is leaked.

In src/bin/psql/variables.c around lines 958 to 970, the function
AssignBindVariable assigns newvalue to current->value and returns true even if
newvalue is NULL due to conversion failure, which silently overwrites a valid
old value. Add an explicit check after calling valid_bind_variable_value to
verify if newvalue is NULL; if it is, do not overwrite current->value, log an
appropriate error, and return false to indicate failure.

In src/bin/psql/variables.c between lines 686 and 731, the variable 'value' is
assigned by calling valid_bind_variable_value() before any validation checks,
causing a memory leak if validation fails and the function returns early. To fix
this, move the call to valid_bind_variable_value() to after all the early
validation checks have passed, or alternatively, ensure that 'value' is freed on
every failure path before returning false.