NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commitcbe733d

committed

repeat() fix:

> Neil Conway <neilc@samurai.com> writes:> > + /* Check for integer overflow */> > + if (tlen / slen != count)> > + elog(ERROR, "Requested buffer is too large.");>> What about slen == 0?Good point -- that wouldn't cause incorrect results or a securityproblem, but it would reject input that we should really accept.Revised patch is attached.Neil Conway

1 parentc76f5aa commitcbe733dCopy full SHA for cbe733d

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- oracle_compat.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/oracle_compat.c‎`

Lines changed: 5 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@`
`9`	`9`	`*`
`10`	`10`	`*`
`11`	`11`	`* IDENTIFICATION`
`12`		`- *$Header: /cvsroot/pgsql/src/backend/utils/adt/oracle_compat.c,v 1.38 2002/06/20 20:51:45 momjian Exp $`
	`12`	`+ *$Header: /cvsroot/pgsql/src/backend/utils/adt/oracle_compat.c,v 1.39 2002/08/22 04:54:20 momjian Exp $`
`13`	`13`	`*`
`14`	`14`	`*-------------------------------------------------------------------------`
`15`	`15`	`*/`
`@@ -997,6 +997,10 @@ repeat(PG_FUNCTION_ARGS)`
`997`	`997`	`slen= (VARSIZE(string)-VARHDRSZ);`
`998`	`998`	`tlen= (VARHDRSZ+ (count*slen));`
`999`	`999`
	`1000`	`+/* Check for integer overflow */`
	`1001`	`+if (slen!=0&&count!=0&&tlen /slen!=count)`
	`1002`	`+elog(ERROR,"Requested buffer is too large.");`
	`1003`	`+`
`1000`	`1004`	`result= (text*)palloc(tlen);`
`1001`	`1005`
`1002`	`1006`	`VARATT_SIZEP(result)=tlen;`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitcbe733d

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/oracle_compat.c‎`

0 commit comments