Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit572fda2

Browse files
committed
Modify wchar conversion routines to not fetch the next byte past the end
of a counted input string. Marinos Yannikos' recent crash report turnsout to be due to applying pg_ascii2wchar_with_len to a TEXT object thatis smack up against the end of memory. This is the second just-barely-reproducible bug report I have seen that traces to some bit of codefetching one more byte than it is allowed to. Let's be more carefulout there, boys and girls.While at it, I changed the code to not risk a similar crash when thereis a truncated multibyte character at the end of an input string. Theoutput in this case might not be the most reasonable output possible;if anyone wants to improve it further, step right up...
1 parentb109b03 commit572fda2

File tree

2 files changed

+33
-35
lines changed

2 files changed

+33
-35
lines changed

‎src/backend/utils/mb/mbutils.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* client encoding and server internal encoding.
44
* (currently mule internal code (mic) is used)
55
* Tatsuo Ishii
6-
* $Id: mbutils.c,v 1.15 2001/02/10 02:31:27 tgl Exp $
6+
* $Id: mbutils.c,v 1.16 2001/03/08 00:24:34 tgl Exp $
77
*/
88
#include"postgres.h"
99

@@ -230,7 +230,7 @@ pg_mbstrlen_with_len(const unsigned char *mbstr, int limit)
230230
intlen=0;
231231
intl;
232232

233-
while (*mbstr&&limit>0)
233+
while (limit>0&&*mbstr)
234234
{
235235
l=pg_mblen(mbstr);
236236
limit-=l;
@@ -252,7 +252,7 @@ pg_mbcliplen(const unsigned char *mbstr, int len, int limit)
252252
intclen=0;
253253
intl;
254254

255-
while (*mbstr&&len>0)
255+
while (len>0&&*mbstr)
256256
{
257257
l=pg_mblen(mbstr);
258258
if ((clen+l)>limit)
@@ -267,7 +267,7 @@ pg_mbcliplen(const unsigned char *mbstr, int len, int limit)
267267
}
268268

269269
/*
270-
*fuctions for utils/init
270+
*functions for utils/init
271271
*/
272272
staticintDatabaseEncoding=MULTIBYTE;
273273

‎src/backend/utils/mb/wchar.c‎

Lines changed: 29 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
* conversion functions between pg_wchar and multi-byte streams.
33
* Tatsuo Ishii
4-
* $Id: wchar.c,v 1.15 2001/02/11 01:59:22 ishii Exp $
4+
* $Id: wchar.c,v 1.16 2001/03/08 00:24:34 tgl Exp $
55
*
66
* WIN1250 client encoding updated by Pavel Behal
77
*
@@ -27,7 +27,7 @@ static int pg_ascii2wchar_with_len
2727
{
2828
intcnt=0;
2929

30-
while (*from&&len>0)
30+
while (len>0&&*from)
3131
{
3232
*to++=*from++;
3333
len--;
@@ -52,23 +52,22 @@ static int pg_euc2wchar_with_len
5252
{
5353
intcnt=0;
5454

55-
while (*from&&len>0)
55+
while (len>0&&*from)
5656
{
57-
if (*from==SS2)
57+
if (*from==SS2&&len >=2)
5858
{
5959
from++;
60-
len--;
6160
*to=0xff&*from++;
62-
len--;
61+
len-=2;
6362
}
64-
elseif (*from==SS3)
63+
elseif (*from==SS3&&len >=3)
6564
{
6665
from++;
6766
*to=*from++ <<8;
6867
*to |=0x3f&*from++;
6968
len-=3;
7069
}
71-
elseif (*from&0x80)
70+
elseif ((*from&0x80)&&len >=2)
7271
{
7372
*to=*from++ <<8;
7473
*to |=*from++;
@@ -140,24 +139,23 @@ static int pg_euccn2wchar_with_len
140139
{
141140
intcnt=0;
142141

143-
while (*from&&len>0)
142+
while (len>0&&*from)
144143
{
145-
if (*from==SS2)
144+
if (*from==SS2&&len >=3)
146145
{
147146
from++;
148-
len--;
149147
*to=0x3f00& (*from++ <<8);
150148
*to=*from++;
151-
len-=2;
149+
len-=3;
152150
}
153-
elseif (*from==SS3)
151+
elseif (*from==SS3&&len >=3)
154152
{
155153
from++;
156154
*to=*from++ <<8;
157155
*to |=0x3f&*from++;
158156
len-=3;
159157
}
160-
elseif (*from&0x80)
158+
elseif ((*from&0x80)&&len >=2)
161159
{
162160
*to=*from++ <<8;
163161
*to |=*from++;
@@ -195,25 +193,24 @@ static int pg_euctw2wchar_with_len
195193
{
196194
intcnt=0;
197195

198-
while (*from&&len>0)
196+
while (len>0&&*from)
199197
{
200-
if (*from==SS2)
198+
if (*from==SS2&&len >=4)
201199
{
202200
from++;
203-
len--;
204201
*to=*from++ <<16;
205202
*to |=*from++ <<8;
206203
*to |=*from++;
207-
len-=3;
204+
len-=4;
208205
}
209-
elseif (*from==SS3)
206+
elseif (*from==SS3&&len >=3)
210207
{
211208
from++;
212209
*to=*from++ <<8;
213210
*to |=0x3f&*from++;
214211
len-=3;
215212
}
216-
elseif (*from&0x80)
213+
elseif ((*from&0x80)&&len >=2)
217214
{
218215
*to=*from++ <<8;
219216
*to |=*from++;
@@ -261,30 +258,30 @@ pg_utf2wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
261258
c3;
262259
intcnt=0;
263260

264-
while (*from&&len>0)
261+
while (len>0&&*from)
265262
{
266263
if ((*from&0x80)==0)
267264
{
268265
*to=*from++;
269266
len--;
270267
}
271-
elseif ((*from&0xe0)==0xc0)
268+
elseif ((*from&0xe0)==0xc0&&len >=2)
272269
{
273270
c1=*from++&0x1f;
274271
c2=*from++&0x3f;
275-
len-=2;
276272
*to=c1 <<6;
277273
*to |=c2;
274+
len-=2;
278275
}
279-
elseif ((*from&0xe0)==0xe0)
276+
elseif ((*from&0xe0)==0xe0&&len >=3)
280277
{
281278
c1=*from++&0x0f;
282279
c2=*from++&0x3f;
283280
c3=*from++&0x3f;
284-
len-=3;
285281
*to=c1 <<12;
286282
*to |=c2 <<6;
287283
*to |=c3;
284+
len-=3;
288285
}
289286
else
290287
{
@@ -326,29 +323,29 @@ pg_mule2wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
326323
{
327324
intcnt=0;
328325

329-
while (*from&&len>0)
326+
while (len>0&&*from)
330327
{
331-
if (IS_LC1(*from))
328+
if (IS_LC1(*from)&&len >=2)
332329
{
333330
*to=*from++ <<16;
334331
*to |=*from++;
335332
len-=2;
336333
}
337-
elseif (IS_LCPRV1(*from))
334+
elseif (IS_LCPRV1(*from)&&len >=3)
338335
{
339336
from++;
340337
*to=*from++ <<16;
341338
*to |=*from++;
342339
len-=3;
343340
}
344-
elseif (IS_LC2(*from))
341+
elseif (IS_LC2(*from)&&len >=3)
345342
{
346343
*to=*from++ <<16;
347344
*to |=*from++ <<8;
348345
*to |=*from++;
349346
len-=3;
350347
}
351-
elseif (IS_LCPRV2(*from))
348+
elseif (IS_LCPRV2(*from)&&len >=4)
352349
{
353350
from++;
354351
*to=*from++ <<16;
@@ -396,9 +393,10 @@ pg_latin12wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
396393
{
397394
intcnt=0;
398395

399-
while (*from&&len-->0)
396+
while (len>0&&*from)
400397
{
401398
*to++=*from++;
399+
len--;
402400
cnt++;
403401
}
404402
*to=0;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp