NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit5e1365a

committed

Fix null-dereference crash in parse_xml_decl().

parse_xml_decl's header comment says you can pass NULL for any unwantedoutput parameter, but it failed to honor this contract for the "standalone"flag. The only currently-affected caller is xml_recv, so the net effect isthat sending a binary XML value containing a standalone parameter in itsxml declaration would crash the backend. Per bug #6044 from ChristopherDillard.In passing, remove useless initializations of parse_xml_decl's outputparameters in xml_parse.Back-patch to 8.3, where this code was introduced.

1 parent4c60a77 commit5e1365aCopy full SHA for 5e1365a

File tree

1 file changed

-4

lines changed

src/backend/utils/adt
- xml.c

1 file changed

-4

lines changed

`‎src/backend/utils/adt/xml.c`

Lines changed: 6 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -1067,13 +1067,15 @@ parse_xml_decl(const xmlChar str, size_t lenp,`
`1067`	`1067`	`if (xmlStrncmp(p, (xmlChar*)"'yes'",5)==0\|\|`
`1068`	`1068`	`xmlStrncmp(p, (xmlChar*)"\"yes\"",5)==0)`
`1069`	`1069`	`{`
`1070`		`-*standalone=1;`
	`1070`	`+if (standalone)`
	`1071`	`+*standalone=1;`
`1071`	`1072`	`p+=5;`
`1072`	`1073`	`}`
`1073`	`1074`	`elseif (xmlStrncmp(p, (xmlChar*)"'no'",4)==0\|\|`
`1074`	`1075`	`xmlStrncmp(p, (xmlChar*)"\"no\"",4)==0)`
`1075`	`1076`	`{`
`1076`		`-*standalone=0;`
	`1077`	`+if (standalone)`
	`1078`	`+*standalone=0;`
`1077`	`1079`	`p+=4;`
`1078`	`1080`	`}`
`1079`	`1081`	`else`
`@@ -1218,8 +1220,8 @@ xml_parse(text *data, XmlOptionType xmloption_arg, bool preserve_whitespace,`
`1218`	`1220`	`{`
`1219`	`1221`	`intres_code;`
`1220`	`1222`	`size_tcount;`
`1221`		`-xmlChar*version=NULL;`
`1222`		`-intstandalone=-1;`
	`1223`	`+xmlChar*version;`
	`1224`	`+intstandalone;`
`1223`	`1225`
`1224`	`1226`	`res_code=parse_xml_decl(utf8string,`
`1225`	`1227`	`&count,&version,NULL,&standalone);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit5e1365a

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/xml.c`

0 commit comments