Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb162660

Browse files
committed
Avoid fetching one past the end of translate()'s "to" parameter.
This is usually harmless, but if you were very unlucky it couldprovoke a segfault due to the "to" string being right up againstthe end of memory. Found via valgrind testing (so we might'vefound it earlier, except that our regression tests lacked anyexercise of translate()'s deletion feature).Fix by switching the order of the test-for-end-of-string andadvance-pointer steps. While here, compute "to_ptr + tolen"just once. (Smarter compilers might figure that out forthemselves, but let's just make sure.)Report and fix by Daniil Anisimov, in bug #17816.Discussion:https://postgr.es/m/17816-70f3d2764e88a108@postgresql.org
1 parent11290c8 commitb162660

File tree

3 files changed

+14
-5
lines changed

3 files changed

+14
-5
lines changed

‎src/backend/utils/adt/oracle_compat.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -723,7 +723,8 @@ translate(PG_FUNCTION_ARGS)
723723
text*to=PG_GETARG_TEXT_PP(2);
724724
text*result;
725725
char*from_ptr,
726-
*to_ptr;
726+
*to_ptr,
727+
*to_end;
727728
char*source,
728729
*target;
729730
intm,
@@ -745,6 +746,7 @@ translate(PG_FUNCTION_ARGS)
745746
from_ptr=VARDATA_ANY(from);
746747
tolen=VARSIZE_ANY_EXHDR(to);
747748
to_ptr=VARDATA_ANY(to);
749+
to_end=to_ptr+tolen;
748750

749751
/*
750752
* The worst-case expansion is to substitute a max-length character for a
@@ -778,16 +780,16 @@ translate(PG_FUNCTION_ARGS)
778780
}
779781
if (i<fromlen)
780782
{
781-
/* substitute */
783+
/* substitute, or delete if no corresponding "to" character */
782784
char*p=to_ptr;
783785

784786
for (i=0;i<from_index;i++)
785787
{
786-
p+=pg_mblen(p);
787-
if (p >= (to_ptr+tolen))
788+
if (p >=to_end)
788789
break;
790+
p+=pg_mblen(p);
789791
}
790-
if (p<(to_ptr+tolen))
792+
if (p<to_end)
791793
{
792794
len=pg_mblen(p);
793795
memcpy(target,p,len);

‎src/test/regress/expected/strings.out

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,6 +1856,12 @@ SELECT translate('12345', '14', 'ax');
18561856
a23x5
18571857
(1 row)
18581858

1859+
SELECT translate('12345', '134', 'a');
1860+
translate
1861+
-----------
1862+
a25
1863+
(1 row)
1864+
18591865
SELECT ascii('x');
18601866
ascii
18611867
-------

‎src/test/regress/sql/strings.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,6 +645,7 @@ SELECT ltrim('zzzytrim', 'xyz');
645645

646646
SELECTtranslate('','14','ax');
647647
SELECTtranslate('12345','14','ax');
648+
SELECTtranslate('12345','134','a');
648649

649650
SELECT ascii('x');
650651
SELECT ascii('');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp