NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commit623f77e

committed

Avoid possibly accessing off the end of memory in SJIS2004 conversion.

The code in shift_jis_20042euc_jis_2004() would fetch two bytes even whenonly one remained in the string. Since conversion functions aren'tsupposed to assume null-terminated input, this poses a small risk offetching past the end of memory and incurring SIGSEGV. No such crash hasbeen identified in the field, but we've certainly seen the equivalenthappen in other code paths, so patch this one all the way back.Report and patch by Noah Misch.

1 parent780a342 commit623f77eCopy full SHA for 623f77e

File tree

1 file changed

-4

lines changed

src/backend/utils/mb/conversion_procs/euc2004_sjis2004
- euc2004_sjis2004.c

1 file changed

-4

lines changed

`‎src/backend/utils/mb/conversion_procs/euc2004_sjis2004/euc2004_sjis2004.c`

Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -218,8 +218,7 @@ get_ten(int b, int *ku)`
`218`	`218`	`staticvoid`
`219`	`219`	`shift_jis_20042euc_jis_2004(constunsignedcharsjis,unsignedcharp,intlen)`
`220`	`220`	`{`
`221`		`-intc1,`
`222`		`-c2;`
	`221`	`+intc1;`
`223`	`222`	`intku,`
`224`	`223`	`ten,`
`225`	`224`	`kubun;`
`@@ -229,7 +228,6 @@ shift_jis_20042euc_jis_2004(const unsigned char sjis, unsigned char p, int len`
`229`	`228`	`while (len>0)`
`230`	`229`	`{`
`231`	`230`	`c1=*sjis;`
`232`		`-c2=sjis[1];`
`233`	`231`
`234`	`232`	`if (!IS_HIGHBIT_SET(c1))`
`235`	`233`	`{`
`@@ -245,7 +243,7 @@ shift_jis_20042euc_jis_2004(const unsigned char sjis, unsigned char p, int len`
`245`	`243`
`246`	`244`	`l=pg_encoding_verifymb(PG_SHIFT_JIS_2004, (constchar*)sjis,len);`
`247`	`245`
`248`		`-if (l<0)`
	`246`	`+if (l<0\|\|l>len)`
`249`	`247`	`report_invalid_encoding(PG_SHIFT_JIS_2004,`
`250`	`248`	`(constchar*)sjis,len);`
`251`	`249`
`@@ -257,6 +255,8 @@ shift_jis_20042euc_jis_2004(const unsigned char sjis, unsigned char p, int len`
`257`	`255`	`}`
`258`	`256`	`elseif (l==2)`
`259`	`257`	`{`
	`258`	`+intc2=sjis[1];`
	`259`	`+`
`260`	`260`	`plane=1;`
`261`	`261`	`ku=1;`
`262`	`262`	`ten=1;`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit623f77e

File tree

1 file changed

1 file changed

`‎src/backend/utils/mb/conversion_procs/euc2004_sjis2004/euc2004_sjis2004.c`

0 commit comments