Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3b37e84

Browse files
committed
Avoid fetching one past the end of translate()'s "to" parameter.
This is usually harmless, but if you were very unlucky it couldprovoke a segfault due to the "to" string being right up againstthe end of memory. Found via valgrind testing (so we might'vefound it earlier, except that our regression tests lacked anyexercise of translate()'s deletion feature).Fix by switching the order of the test-for-end-of-string andadvance-pointer steps. While here, compute "to_ptr + tolen"just once. (Smarter compilers might figure that out forthemselves, but let's just make sure.)Report and fix by Daniil Anisimov, in bug #17816.Discussion:https://postgr.es/m/17816-70f3d2764e88a108@postgresql.org
1 parentab5b76c commit3b37e84

File tree

3 files changed

+14
-5
lines changed

3 files changed

+14
-5
lines changed

‎src/backend/utils/adt/oracle_compat.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -723,7 +723,8 @@ translate(PG_FUNCTION_ARGS)
723723
text*to=PG_GETARG_TEXT_PP(2);
724724
text*result;
725725
char*from_ptr,
726-
*to_ptr;
726+
*to_ptr,
727+
*to_end;
727728
char*source,
728729
*target;
729730
intm,
@@ -745,6 +746,7 @@ translate(PG_FUNCTION_ARGS)
745746
from_ptr=VARDATA_ANY(from);
746747
tolen=VARSIZE_ANY_EXHDR(to);
747748
to_ptr=VARDATA_ANY(to);
749+
to_end=to_ptr+tolen;
748750

749751
/*
750752
* The worst-case expansion is to substitute a max-length character for a
@@ -778,16 +780,16 @@ translate(PG_FUNCTION_ARGS)
778780
}
779781
if (i<fromlen)
780782
{
781-
/* substitute */
783+
/* substitute, or delete if no corresponding "to" character */
782784
char*p=to_ptr;
783785

784786
for (i=0;i<from_index;i++)
785787
{
786-
p+=pg_mblen(p);
787-
if (p >= (to_ptr+tolen))
788+
if (p >=to_end)
788789
break;
790+
p+=pg_mblen(p);
789791
}
790-
if (p<(to_ptr+tolen))
792+
if (p<to_end)
791793
{
792794
len=pg_mblen(p);
793795
memcpy(target,p,len);

‎src/test/regress/expected/strings.out

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1988,6 +1988,12 @@ SELECT translate('12345', '14', 'ax');
19881988
a23x5
19891989
(1 row)
19901990

1991+
SELECT translate('12345', '134', 'a');
1992+
translate
1993+
-----------
1994+
a25
1995+
(1 row)
1996+
19911997
SELECT ascii('x');
19921998
ascii
19931999
-------

‎src/test/regress/sql/strings.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -679,6 +679,7 @@ SELECT ltrim('zzzytrim', 'xyz');
679679

680680
SELECTtranslate('','14','ax');
681681
SELECTtranslate('12345','14','ax');
682+
SELECTtranslate('12345','134','a');
682683

683684
SELECT ascii('x');
684685
SELECT ascii('');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp