Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commiteae0913

Browse files
committed
Avoid fetching one past the end of translate()'s "to" parameter.
This is usually harmless, but if you were very unlucky it couldprovoke a segfault due to the "to" string being right up againstthe end of memory. Found via valgrind testing (so we might'vefound it earlier, except that our regression tests lacked anyexercise of translate()'s deletion feature).Fix by switching the order of the test-for-end-of-string andadvance-pointer steps. While here, compute "to_ptr + tolen"just once. (Smarter compilers might figure that out forthemselves, but let's just make sure.)Report and fix by Daniil Anisimov, in bug #17816.Discussion:https://postgr.es/m/17816-70f3d2764e88a108@postgresql.org
1 parentb5784e6 commiteae0913

File tree

3 files changed

+14
-5
lines changed

3 files changed

+14
-5
lines changed

‎src/backend/utils/adt/oracle_compat.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -800,7 +800,8 @@ translate(PG_FUNCTION_ARGS)
800800
text*to=PG_GETARG_TEXT_PP(2);
801801
text*result;
802802
char*from_ptr,
803-
*to_ptr;
803+
*to_ptr,
804+
*to_end;
804805
char*source,
805806
*target;
806807
intm,
@@ -822,6 +823,7 @@ translate(PG_FUNCTION_ARGS)
822823
from_ptr=VARDATA_ANY(from);
823824
tolen=VARSIZE_ANY_EXHDR(to);
824825
to_ptr=VARDATA_ANY(to);
826+
to_end=to_ptr+tolen;
825827

826828
/*
827829
* The worst-case expansion is to substitute a max-length character for a
@@ -856,16 +858,16 @@ translate(PG_FUNCTION_ARGS)
856858
}
857859
if (i<fromlen)
858860
{
859-
/* substitute */
861+
/* substitute, or delete if no corresponding "to" character */
860862
char*p=to_ptr;
861863

862864
for (i=0;i<from_index;i++)
863865
{
864-
p+=pg_mblen(p);
865-
if (p >= (to_ptr+tolen))
866+
if (p >=to_end)
866867
break;
868+
p+=pg_mblen(p);
867869
}
868-
if (p<(to_ptr+tolen))
870+
if (p<to_end)
869871
{
870872
len=pg_mblen(p);
871873
memcpy(target,p,len);

‎src/test/regress/expected/strings.out

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2506,6 +2506,12 @@ SELECT translate('12345', '14', 'ax');
25062506
a23x5
25072507
(1 row)
25082508

2509+
SELECT translate('12345', '134', 'a');
2510+
translate
2511+
-----------
2512+
a25
2513+
(1 row)
2514+
25092515
SELECT ascii('x');
25102516
ascii
25112517
-------

‎src/test/regress/sql/strings.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -813,6 +813,7 @@ SELECT ltrim('zzzytrim', 'xyz');
813813

814814
SELECTtranslate('','14','ax');
815815
SELECTtranslate('12345','14','ax');
816+
SELECTtranslate('12345','134','a');
816817

817818
SELECT ascii('x');
818819
SELECT ascii('');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp