forked frompostgres/postgres
- Notifications
You must be signed in to change notification settings - Fork6
Commit900a8d5
committed
Tighten array dimensionality checks in Perl -> SQL array conversion.
plperl_array_to_datum() wasn't sufficiently careful about checkingthat nested lists represent a rectangular array structure; it wouldaccept inputs such as "[1, []]". This is a bit related to thePL/Python bug fixed in commit81eaaf6, but it doesn't seem toprovide any direct route to a memory stomp. Instead the likelyfailure mode is for makeMdArrayResult to be passed fewer Datums thanthe claimed array dimensionality requires, possibly leading to a wildpointer dereference and SIGSEGV.Per report from Alexander Lakhin. It's been broken for a longtime, so back-patch to all supported branches.Discussion:https://postgr.es/m/5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com1 parentff9203f commit900a8d5
File tree
3 files changed
+119
-23
lines changed- src/pl/plperl
- expected
- sql
3 files changed
+119
-23
lines changedLines changed: 43 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
215 | 215 |
| |
216 | 216 |
| |
217 | 217 |
| |
| 218 | + | |
| 219 | + | |
| 220 | + | |
| 221 | + | |
| 222 | + | |
| 223 | + | |
| 224 | + | |
| 225 | + | |
| 226 | + | |
| 227 | + | |
| 228 | + | |
| 229 | + | |
| 230 | + | |
| 231 | + | |
| 232 | + | |
| 233 | + | |
| 234 | + | |
| 235 | + | |
| 236 | + | |
| 237 | + | |
| 238 | + | |
| 239 | + | |
| 240 | + | |
| 241 | + | |
| 242 | + | |
| 243 | + | |
| 244 | + | |
| 245 | + | |
| 246 | + | |
| 247 | + | |
| 248 | + | |
| 249 | + | |
| 250 | + | |
| 251 | + | |
| 252 | + | |
| 253 | + | |
| 254 | + | |
| 255 | + | |
| 256 | + | |
| 257 | + | |
| 258 | + | |
| 259 | + | |
| 260 | + | |
218 | 261 |
| |
219 | 262 |
| |
220 | 263 |
| |
|
Lines changed: 39 additions & 23 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
276 | 276 |
| |
277 | 277 |
| |
278 | 278 |
| |
279 |
| - | |
| 279 | + | |
280 | 280 |
| |
281 |
| - | |
| 281 | + | |
282 | 282 |
| |
283 | 283 |
| |
284 | 284 |
| |
| |||
1167 | 1167 |
| |
1168 | 1168 |
| |
1169 | 1169 |
| |
| 1170 | + | |
| 1171 | + | |
| 1172 | + | |
| 1173 | + | |
| 1174 | + | |
1170 | 1175 |
| |
1171 | 1176 |
| |
1172 |
| - | |
| 1177 | + | |
1173 | 1178 |
| |
1174 |
| - | |
| 1179 | + | |
1175 | 1180 |
| |
1176 | 1181 |
| |
1177 | 1182 |
| |
| |||
1191 | 1196 |
| |
1192 | 1197 |
| |
1193 | 1198 |
| |
1194 |
| - | |
1195 |
| - | |
1196 |
| - | |
1197 |
| - | |
1198 |
| - | |
1199 |
| - | |
1200 |
| - | |
1201 | 1199 |
| |
1202 | 1200 |
| |
1203 | 1201 |
| |
| 1202 | + | |
| 1203 | + | |
| 1204 | + | |
| 1205 | + | |
| 1206 | + | |
| 1207 | + | |
| 1208 | + | |
| 1209 | + | |
| 1210 | + | |
| 1211 | + | |
| 1212 | + | |
| 1213 | + | |
1204 | 1214 |
| |
1205 | 1215 |
| |
1206 | 1216 |
| |
1207 |
| - | |
| 1217 | + | |
| 1218 | + | |
1208 | 1219 |
| |
1209 | 1220 |
| |
1210 | 1221 |
| |
1211 | 1222 |
| |
1212 | 1223 |
| |
1213 |
| - | |
| 1224 | + | |
1214 | 1225 |
| |
1215 |
| - | |
| 1226 | + | |
1216 | 1227 |
| |
1217 | 1228 |
| |
1218 | 1229 |
| |
| |||
1234 | 1245 |
| |
1235 | 1246 |
| |
1236 | 1247 |
| |
1237 |
| - | |
| 1248 | + | |
| 1249 | + | |
| 1250 | + | |
| 1251 | + | |
| 1252 | + | |
| 1253 | + | |
| 1254 | + | |
1238 | 1255 |
| |
1239 | 1256 |
| |
1240 | 1257 |
| |
| |||
1247 | 1264 |
| |
1248 | 1265 |
| |
1249 | 1266 |
| |
1250 |
| - | |
| 1267 | + | |
| 1268 | + | |
1251 | 1269 |
| |
1252 | 1270 |
| |
1253 | 1271 |
| |
| |||
1263 | 1281 |
| |
1264 | 1282 |
| |
1265 | 1283 |
| |
1266 |
| - | |
1267 |
| - | |
1268 | 1284 |
| |
1269 | 1285 |
| |
1270 | 1286 |
| |
1271 |
| - | |
| 1287 | + | |
1272 | 1288 |
| |
1273 |
| - | |
| 1289 | + | |
1274 | 1290 |
| |
1275 |
| - | |
| 1291 | + | |
1276 | 1292 |
| |
1277 | 1293 |
| |
1278 | 1294 |
| |
1279 |
| - | |
1280 |
| - | |
| 1295 | + | |
| 1296 | + | |
1281 | 1297 |
| |
1282 | 1298 |
| |
1283 | 1299 |
| |
|
Lines changed: 37 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
159 | 159 |
| |
160 | 160 |
| |
161 | 161 |
| |
| 162 | + | |
| 163 | + | |
| 164 | + | |
| 165 | + | |
| 166 | + | |
| 167 | + | |
| 168 | + | |
| 169 | + | |
| 170 | + | |
| 171 | + | |
| 172 | + | |
| 173 | + | |
| 174 | + | |
| 175 | + | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
| 193 | + | |
| 194 | + | |
| 195 | + | |
| 196 | + | |
| 197 | + | |
| 198 | + | |
162 | 199 |
| |
163 | 200 |
| |
164 | 201 |
| |
|
0 commit comments
Comments
(0)