- Notifications
You must be signed in to change notification settings - Fork5
Commit0887fa1
committed
Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on the same
page about the maximum UTF8 sequence length we support (4 bytes since 8.1,3 before that). pg_utf2wchar_with_len never got updated to support 4-bytecharacters at all, and in any case had a buffer-overrun risk in that itcould produce multiple pg_wchars from what mblen claims to be just one UTF8character. The only reason we don't have a major security hole is that mostcallers allocate worst-case output buffers; the sole exception in releasedversions appears to be pre-8.2 iwchareq() (ie, ILIKE), which can be crasheddue to zeroing out its return address --- but AFAICS that can't be exploitedfor anything more than a crash, due to inability to control what gets writtenthere. Per report from James Russell and Michael Fuhr.Pre-8.1 the risk is much less, but I still think pg_utf2wchar_with_len'sbehavior given an incomplete final character risks buffer overrun, soback-patch that logic change anyway.This patch also makes sure that UTF8 sequences exceeding the supportedlength (whichever it is) are consistently treated as error cases, ratherthan being treated like a valid shorter sequence in some places.1 parent07cf99a commit0887fa1
1 file changed
+43
-17
lines changedLines changed: 43 additions & 17 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
1 | 1 |
| |
2 | 2 |
| |
3 | 3 |
| |
4 |
| - | |
| 4 | + | |
5 | 5 |
| |
6 | 6 |
| |
7 | 7 |
| |
| |||
364 | 364 |
| |
365 | 365 |
| |
366 | 366 |
| |
367 |
| - | |
368 |
| - | |
| 367 | + | |
| 368 | + | |
369 | 369 |
| |
370 | 370 |
| |
371 | 371 |
| |
372 | 372 |
| |
373 | 373 |
| |
374 | 374 |
| |
375 |
| - | |
376 |
| - | |
377 |
| - | |
378 | 375 |
| |
| 376 | + | |
| 377 | + | |
| 378 | + | |
| 379 | + | |
379 | 380 |
| |
380 | 381 |
| |
381 | 382 |
| |
382 |
| - | |
| 383 | + | |
383 | 384 |
| |
384 | 385 |
| |
385 | 386 |
| |
386 | 387 |
| |
387 |
| - | |
| 388 | + | |
388 | 389 |
| |
| 390 | + | |
| 391 | + | |
389 | 392 |
| |
390 | 393 |
| |
391 |
| - | |
392 |
| - | |
| 394 | + | |
393 | 395 |
| |
394 | 396 |
| |
395 |
| - | |
| 397 | + | |
396 | 398 |
| |
| 399 | + | |
| 400 | + | |
397 | 401 |
| |
398 | 402 |
| |
399 | 403 |
| |
400 |
| - | |
401 |
| - | |
402 |
| - | |
| 404 | + | |
403 | 405 |
| |
404 | 406 |
| |
| 407 | + | |
| 408 | + | |
| 409 | + | |
| 410 | + | |
| 411 | + | |
| 412 | + | |
| 413 | + | |
| 414 | + | |
| 415 | + | |
| 416 | + | |
| 417 | + | |
405 | 418 |
| |
406 | 419 |
| |
| 420 | + | |
407 | 421 |
| |
408 | 422 |
| |
409 | 423 |
| |
| |||
415 | 429 |
| |
416 | 430 |
| |
417 | 431 |
| |
418 |
| - | |
| 432 | + | |
| 433 | + | |
| 434 | + | |
| 435 | + | |
| 436 | + | |
| 437 | + | |
| 438 | + | |
| 439 | + | |
| 440 | + | |
419 | 441 |
| |
420 | 442 |
| |
421 | 443 |
| |
422 | 444 |
| |
423 |
| - | |
| 445 | + | |
424 | 446 |
| |
425 | 447 |
| |
426 | 448 |
| |
| |||
430 | 452 |
| |
431 | 453 |
| |
432 | 454 |
| |
| 455 | + | |
433 | 456 |
| |
434 | 457 |
| |
435 | 458 |
| |
436 | 459 |
| |
| 460 | + | |
| 461 | + | |
| 462 | + | |
437 | 463 |
| |
438 | 464 |
| |
439 | 465 |
| |
| |||
596 | 622 |
| |
597 | 623 |
| |
598 | 624 |
| |
599 |
| - | |
| 625 | + | |
600 | 626 |
| |
601 | 627 |
| |
602 | 628 |
| |
|
0 commit comments
Comments
(0)