Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit44f1fc8

Browse files
committed
Fix out-of-memory handling in ecpglib.
ecpg_build_params() would crash on a null pointer dereference ifrealloc() failed, due to updating the persistent "stmt" structtoo aggressively. (Even without the crash, this would've leakedthe old storage that we were trying to realloc.)Per Coverity. This seems to have been broken in commit0cc0507,so back-patch into v12.
1 parent9c679a0 commit44f1fc8

File tree

1 file changed

+24
-13
lines changed

1 file changed

+24
-13
lines changed

‎src/interfaces/ecpg/ecpglib/execute.c

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1499,26 +1499,37 @@ ecpg_build_params(struct statement *stmt)
14991499
}
15001500
else
15011501
{
1502-
if (!(stmt->paramvalues= (char**)ecpg_realloc(stmt->paramvalues,sizeof(char*)* (stmt->nparams+1),stmt->lineno)))
1502+
boolrealloc_failed= false;
1503+
char**newparamvalues;
1504+
int*newparamlengths;
1505+
int*newparamformats;
1506+
1507+
/* enlarge all the param arrays */
1508+
if ((newparamvalues= (char**)ecpg_realloc(stmt->paramvalues,sizeof(char*)* (stmt->nparams+1),stmt->lineno)))
1509+
stmt->paramvalues=newparamvalues;
1510+
else
1511+
realloc_failed= true;
1512+
1513+
if ((newparamlengths= (int*)ecpg_realloc(stmt->paramlengths,sizeof(int)* (stmt->nparams+1),stmt->lineno)))
1514+
stmt->paramlengths=newparamlengths;
1515+
else
1516+
realloc_failed= true;
1517+
1518+
if ((newparamformats= (int*)ecpg_realloc(stmt->paramformats,sizeof(int)* (stmt->nparams+1),stmt->lineno)))
1519+
stmt->paramformats=newparamformats;
1520+
else
1521+
realloc_failed= true;
1522+
1523+
if (realloc_failed)
15031524
{
15041525
ecpg_free_params(stmt, false);
15051526
ecpg_free(tobeinserted);
15061527
return false;
15071528
}
1508-
stmt->paramvalues[stmt->nparams]=tobeinserted;
15091529

1510-
if (!(stmt->paramlengths= (int*)ecpg_realloc(stmt->paramlengths,sizeof(int)* (stmt->nparams+1),stmt->lineno)))
1511-
{
1512-
ecpg_free_params(stmt, false);
1513-
return false;
1514-
}
1530+
/* only now can we assign ownership of "tobeinserted" to stmt */
1531+
stmt->paramvalues[stmt->nparams]=tobeinserted;
15151532
stmt->paramlengths[stmt->nparams]=binary_length;
1516-
1517-
if (!(stmt->paramformats= (int*)ecpg_realloc(stmt->paramformats,sizeof(int)* (stmt->nparams+1),stmt->lineno)))
1518-
{
1519-
ecpg_free_params(stmt, false);
1520-
return false;
1521-
}
15221533
stmt->paramformats[stmt->nparams]= (binary_format ?1 :0);
15231534
stmt->nparams++;
15241535

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp