postgres.git / summary / log / commit / refs

commit    384dfbde19330541f7fb487f9352949aa06c812e
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Wed Mar 23 14:43:13 2016 +0000

    Fix unsafe use of strtol() on a non-null-terminated Text datum.
    
    jsonb_set() could produce wrong answers or incorrect error reports, or in
    the worst case even crash, when trying to convert a path-array element into
    an integer for use as an array subscript.  Per report from Vitaly Burovoy.
    Back-patch to 9.5 where the faulty code was introduced (in commit
    c6947010ceb42143).
    
    Michael Paquier


 src/backend/utils/adt/jsonfuncs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/jsonfuncs.c b/src/backend/utils/adt/jsonfuncs.c
index 363afa76990..cc6dadf7932 100644
--- a/src/backend/utils/adt/jsonfuncs.c
+++ b/src/backend/utils/adt/jsonfuncs.c
@@ -3873,7 +3873,7 @@ setPathArray(JsonbIterator **it, Datum *path_elems, bool *path_nulls,
 	/* pick correct index */
 	if (level < path_len && !path_nulls[level])
 	{
-		char	   *c = VARDATA_ANY(path_elems[level]);
+		char	   *c = TextDatumGetCString(path_elems[level]);
 		long		lindex;
 
 		errno = 0;


[parent: 8320c625d983]