Commit0fe5a4c

committed

Fix off-by-one in memory allocation for quote_literal_cstr().

The calculation didn't take into account the NULL terminator. That leadto overwriting the palloc'd buffer by one byte, if the input consistsentirely of backslashes. For example "format('%L', E'\\')".Fixes bug #14468. Backpatch to all supported versions.Report:https://www.postgresql.org/message-id/20161216105001.13334.42819%40wrigleys.postgresql.org

1 parent6f4d38d commit0fe5a4cCopy full SHA for 0fe5a4c

File tree

-1

lines changed

-1

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ quote_literal_cstr(const char *rawstr)`
`107`	`107`
`108`	`108`	`len=strlen(rawstr);`
`109`	`109`	`/* We make a worst-case result area; wasting a little space is OK */`
`110`		`-result=palloc(len*2+3);`
	`110`	`+result=palloc(len*2+3+1);`
`111`	`111`
`112`	`112`	`newlen=quote_literal_internal(result,rawstr,len);`
`113`	`113`	`result[newlen]='\0';`

Comments

(0)