NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit299498d

committed

Fix possible buffer overrun in contrib/pg_trgm.

Allow for the possibility that folding a string to lower case makes itlonger (due to replacing a character with a longer multibyte character).This doesn't change the number of trigrams that will be extracted, butit does affect the required size of an intermediate buffer ingenerate_trgm(). Per bug #8821 from Ufuk Kayserilioglu.Also install some checks that the input string length is not so largeas to cause overflow in the calculations of palloc request sizes.Back-patch to all supported versions.

1 parentf6d6b42 commit299498dCopy full SHA for 299498d

File tree

1 file changed

+35

-3

lines changed

contrib/pg_trgm
- trgm_op.c

1 file changed

+35

-3

lines changed

`‎contrib/pg_trgm/trgm_op.c`

Lines changed: 35 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,7 @@`
`9`	`9`
`10`	`10`	`#include"catalog/pg_type.h"`
`11`	`11`	`#include"tsearch/ts_locale.h"`
	`12`	`+#include"utils/memutils.h"`
`12`	`13`
`13`	`14`
`14`	`15`	`PG_MODULE_MAGIC;`
`@@ -191,6 +192,18 @@ generate_trgm(char *str, int slen)`
`191`	`192`	`char*bword,`
`192`	`193`	`*eword;`
`193`	`194`
	`195`	`+/*`
	`196`	`+ * Guard against possible overflow in the palloc requests below. (We`
	`197`	`+ * don't worry about the additive constants, since palloc can detect`
	`198`	`+ * requests that are a little above MaxAllocSize --- we just need to`
	`199`	`+ * prevent integer overflow in the multiplications.)`
	`200`	`+ */`
	`201`	`+if ((Size) (slen /2) >= (MaxAllocSize / (sizeof(trgm)*3))\|\|`
	`202`	`+(Size)slen >= (MaxAllocSize /pg_database_encoding_max_length()))`
	`203`	`+ereport(ERROR,`
	`204`	`+(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),`
	`205`	`+errmsg("out of memory")));`
	`206`	`+`
`194`	`207`	`trg= (TRGM)palloc(TRGMHDRSIZE+sizeof(trgm) (slen /2+1)*3);`
`195`	`208`	`trg->flag=ARRKEY;`
`196`	`209`	`SET_VARSIZE(trg,TRGMHDRSIZE);`
`@@ -200,7 +213,8 @@ generate_trgm(char *str, int slen)`
`200`	`213`
`201`	`214`	`tptr=GETARR(trg);`
`202`	`215`
`203`		`-buf=palloc(sizeof(char)* (slen+4));`
	`216`	`+/* Allocate a buffer for case-folded, blank-padded words */`
	`217`	`+buf= (char)palloc(slenpg_database_encoding_max_length()+4);`
`204`	`218`
`205`	`219`	`if (LPADDING>0)`
`206`	`220`	`{`
`@@ -224,6 +238,7 @@ generate_trgm(char *str, int slen)`
`224`	`238`	`#ifdefIGNORECASE`
`225`	`239`	`pfree(bword);`
`226`	`240`	`#endif`
	`241`	`+`
`227`	`242`	`buf[LPADDING+bytelen]=' ';`
`228`	`243`	`buf[LPADDING+bytelen+1]=' ';`
`229`	`244`
`@@ -239,7 +254,10 @@ generate_trgm(char *str, int slen)`
`239`	`254`	`if ((len=tptr-GETARR(trg))==0)`
`240`	`255`	`returntrg;`
`241`	`256`
`242`		`-if (len>0)`
	`257`	`+/*`
	`258`	`+ * Make trigrams unique.`
	`259`	`+ */`
	`260`	`+if (len>1)`
`243`	`261`	`{`
`244`	`262`	`qsort((void*)GETARR(trg),len,sizeof(trgm),comp_trgm);`
`245`	`263`	`len=unique_array(GETARR(trg),len);`
`@@ -422,6 +440,18 @@ generate_wildcard_trgm(const char *str, int slen)`
`422`	`440`	`bytelen;`
`423`	`441`	`constchar*eword;`
`424`	`442`
	`443`	`+/*`
	`444`	`+ * Guard against possible overflow in the palloc requests below. (We`
	`445`	`+ * don't worry about the additive constants, since palloc can detect`
	`446`	`+ * requests that are a little above MaxAllocSize --- we just need to`
	`447`	`+ * prevent integer overflow in the multiplications.)`
	`448`	`+ */`
	`449`	`+if ((Size) (slen /2) >= (MaxAllocSize / (sizeof(trgm)*3))\|\|`
	`450`	`+(Size)slen >= (MaxAllocSize /pg_database_encoding_max_length()))`
	`451`	`+ereport(ERROR,`
	`452`	`+(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),`
	`453`	`+errmsg("out of memory")));`
	`454`	`+`
`425`	`455`	`trg= (TRGM)palloc(TRGMHDRSIZE+sizeof(trgm) (slen /2+1)*3);`
`426`	`456`	`trg->flag=ARRKEY;`
`427`	`457`	`SET_VARSIZE(trg,TRGMHDRSIZE);`
`@@ -431,6 +461,7 @@ generate_wildcard_trgm(const char *str, int slen)`
`431`	`461`
`432`	`462`	`tptr=GETARR(trg);`
`433`	`463`
	`464`	`+/* Allocate a buffer for blank-padded, but not yet case-folded, words */`
`434`	`465`	`buf=palloc(sizeof(char)* (slen+4));`
`435`	`466`
`436`	`467`	`/*`
`@@ -451,6 +482,7 @@ generate_wildcard_trgm(const char *str, int slen)`
`451`	`482`	`* count trigrams`
`452`	`483`	`*/`
`453`	`484`	`tptr=make_trigrams(tptr,buf2,bytelen,charlen);`
	`485`	`+`
`454`	`486`	`#ifdefIGNORECASE`
`455`	`487`	`pfree(buf2);`
`456`	`488`	`#endif`
`@@ -464,7 +496,7 @@ generate_wildcard_trgm(const char *str, int slen)`
`464`	`496`	`/*`
`465`	`497`	`* Make trigrams unique.`
`466`	`498`	`*/`
`467`		`-if (len>0)`
	`499`	`+if (len>1)`
`468`	`500`	`{`
`469`	`501`	`qsort((void*)GETARR(trg),len,sizeof(trgm),comp_trgm);`
`470`	`502`	`len=unique_array(GETARR(trg),len);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit299498d

File tree

1 file changed

1 file changed

`‎contrib/pg_trgm/trgm_op.c`

0 commit comments