NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commite7370ba

committed

Fix xslt_process() to ensure that it inserts a NULL terminator after the

last pair of parameter name/value strings, even when there are MAXPARAMSof them. Aboriginal bug in contrib/xml2, noted while studying bug #4912(though I'm not sure whether there's something else involved in thatreport).This might be thought a security issue, since it's a potential backendcrash; but considering that untrustworthy users shouldn't be allowedto get their hands on xslt_process() anyway, it's probably not worthgetting excited about.

1 parentb11ce56 commite7370baCopy full SHA for e7370ba

File tree

1 file changed

+12

-8

lines changed

contrib/xml2
- xslt_proc.c

1 file changed

+12

-8

lines changed

`‎contrib/xml2/xslt_proc.c`

Lines changed: 12 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`/*`
`2`		`- * $PostgreSQL: pgsql/contrib/xml2/xslt_proc.c,v 1.15 2009/06/11 14:48:53 momjian Exp $`
	`2`	`+ * $PostgreSQL: pgsql/contrib/xml2/xslt_proc.c,v 1.16 2009/07/10 00:32:00 tgl Exp $`
`3`	`3`	`*`
`4`	`4`	`* XSLT processing functions (requiring libxslt)`
`5`	`5`	`*`
`@@ -38,7 +38,8 @@ static void parse_params(const char *params, text paramstr);`
`38`	`38`	`Datumxslt_process(PG_FUNCTION_ARGS);`
`39`	`39`
`40`	`40`
`41`		`-#defineMAXPARAMS 20`
	`41`	`+#defineMAXPARAMS 20/* must be even, see parse_params() */`
	`42`	`+`
`42`	`43`
`43`	`44`	`PG_FUNCTION_INFO_V1(xslt_process);`
`44`	`45`
`@@ -129,12 +130,11 @@ xslt_process(PG_FUNCTION_ARGS)`
`129`	`130`	`}`
`130`	`131`
`131`	`132`
`132`		`-void`
	`133`	`+staticvoid`
`133`	`134`	`parse_params(constchar*params,textparamstr)`
`134`	`135`	`{`
`135`	`136`	`char*pos;`
`136`	`137`	`char*pstr;`
`137`		`-`
`138`	`138`	`inti;`
`139`	`139`	`char*nvsep="=";`
`140`	`140`	`char*itsep=",";`
`@@ -154,11 +154,13 @@ parse_params(const char *params, text paramstr)`
`154`	`154`	`}`
`155`	`155`	`else`
`156`	`156`	`{`
`157`		`-params[i]=NULL;`
	`157`	`+/* No equal sign, so ignore this "parameter" */`
	`158`	`+/* We'll reset params[i] to NULL below the loop */`
`158`	`159`	`break;`
`159`	`160`	`}`
`160`	`161`	`/* Value */`
`161`	`162`	`i++;`
	`163`	`+/* since MAXPARAMS is even, we still have i < MAXPARAMS */`
`162`	`164`	`params[i]=pos;`
`163`	`165`	`pos=strstr(pos,itsep);`
`164`	`166`	`if (pos!=NULL)`
`@@ -167,9 +169,11 @@ parse_params(const char *params, text paramstr)`
`167`	`169`	`pos++;`
`168`	`170`	`}`
`169`	`171`	`else`
	`172`	`+{`
	`173`	`+i++;`
`170`	`174`	`break;`
`171`		`-`
	`175`	`+}`
`172`	`176`	`}`
`173`		`-if (i<MAXPARAMS)`
`174`		`-params[i+1]=NULL;`
	`177`	`+`
	`178`	`+params[i]=NULL;`
`175`	`179`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commite7370ba

File tree

1 file changed

1 file changed

`‎contrib/xml2/xslt_proc.c`

0 commit comments