NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commitfe0e1a6

committed

Fix PQsetvalue() to avoid possible crash when adding a new tuple.

PQsetvalue unnecessarily duplicated the logic in pqAddTuple, and didn'tduplicate it exactly either --- pqAddTuple does not care what is in thetuple-pointer array positions beyond the last valid entry, whereas thecode in PQsetvalue assumed such positions would contain NULL. This ledto possible crashes if PQsetvalue was applied to a PGresult that hadpreviously been enlarged with pqAddTuple, for instance one built from aserver query. Fix by relying on pqAddTuple instead of duplicating logic,and not assuming anything about the contents of res->tuples[res->ntups].Back-patch to 8.4, where PQsetvalue was introduced.Andrew Chernow

1 parent431b7b8 commitfe0e1a6Copy full SHA for fe0e1a6

File tree

1 file changed

-23

lines changed

src/interfaces/libpq
- fe-exec.c

1 file changed

-23

lines changed

`‎src/interfaces/libpq/fe-exec.c`

Lines changed: 4 additions & 23 deletions

Original file line number	Diff line number	Diff line change
`@@ -422,28 +422,8 @@ PQsetvalue(PGresult res, int tup_num, int field_num, char value, int len)`
`422`	`422`	`if (tup_num<0\|\|tup_num>res->ntups)`
`423`	`423`	`return FALSE;`
`424`	`424`
`425`		`-/* need to grow the tuple table? */`
`426`		`-if (res->ntups >=res->tupArrSize)`
`427`		`-{`
`428`		`-intn=res->tupArrSize ?res->tupArrSize*2 :128;`
`429`		`-PGresAttValue**tups;`
`430`		`-`
`431`		`-if (res->tuples)`
`432`		`-tups= (PGresAttValue*)realloc(res->tuples,nsizeof(PGresAttValue*));`
`433`		`-else`
`434`		`-tups= (PGresAttValue*)malloc(nsizeof(PGresAttValue*));`
`435`		`-`
`436`		`-if (!tups)`
`437`		`-return FALSE;`
`438`		`-`
`439`		`-memset(tups+res->tupArrSize,0,`
`440`		`- (n-res->tupArrSize)sizeof(PGresAttValue));`
`441`		`-res->tuples=tups;`
`442`		`-res->tupArrSize=n;`
`443`		`-}`
`444`		`-`
`445`	`425`	`/* need to allocate a new tuple? */`
`446`		`-if (tup_num==res->ntups&& !res->tuples[tup_num])`
	`426`	`+if (tup_num==res->ntups)`
`447`	`427`	`{`
`448`	`428`	`PGresAttValue*tup;`
`449`	`429`	`inti;`
`@@ -462,8 +442,9 @@ PQsetvalue(PGresult res, int tup_num, int field_num, char value, int len)`
`462`	`442`	`tup[i].value=res->null_field;`
`463`	`443`	`}`
`464`	`444`
`465`		`-res->tuples[tup_num]=tup;`
`466`		`-res->ntups++;`
	`445`	`+/* add it to the array */`
	`446`	`+if (!pqAddTuple(res,tup))`
	`447`	`+return FALSE;`
`467`	`448`	`}`
`468`	`449`
`469`	`450`	`attval=&res->tuples[tup_num][field_num];`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitfe0e1a6

File tree

1 file changed

1 file changed

`‎src/interfaces/libpq/fe-exec.c`

0 commit comments