pgpool2.git / summary / log / commit / refs

commit    475091c9e3af860ad1338fa63f1b479aaa98a336
Author:   Tatsuo Ishii <ishii at sraoss.co.jp>
Date:     Thu Aug 06 07:46:42 2009 +0000

    Fix buffer overrun error which mangled kind mismatch error message
    in pool_send_error_message().
    Bug rpeort by Takahiro Itagaki at [pgsql-jp: 39950].
    Fix suggested by Akio Ishida at [pgsql-jp: 39952].


 pool_process_query.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pool_process_query.c b/pool_process_query.c
index 80e140521..fb77786c0 100644
--- a/pool_process_query.c
+++ b/pool_process_query.c
@@ -2383,8 +2383,16 @@ void pool_send_error_message(POOL_CONNECTION *frontend, int protoMajor,
 							 char *file,
 							 int line)
 {
-#define MAXDATA	1024
-#define MAXMSGBUF 128
+/*
+ * Buffer length for each message part
+ */
+#define MAXMSGBUF 256
+/*
+ * Buffer length for result message buffer.
+ * Since msg is consisted of 7 parts, msg buffer should be large
+ * enough to hold those message parts
+*/
+#define MAXDATA	(MAXMSGBUF+1)*7+1
 
 	pool_set_nonblock(frontend->fd);
 
@@ -2407,16 +2415,19 @@ void pool_send_error_message(POOL_CONNECTION *frontend, int protoMajor,
 
 		/* error level */
 		thislen = snprintf(msgbuf, MAXMSGBUF, "SERROR");
+		thislen = Min(thislen, MAXMSGBUF);
 		memcpy(data +len, msgbuf, thislen+1);
 		len += thislen + 1;
 
 		/* code */
 		thislen = snprintf(msgbuf, MAXMSGBUF, "C%s", code);
+		thislen = Min(thislen, MAXMSGBUF);
 		memcpy(data +len, msgbuf, thislen+1);
 		len += thislen + 1;
 
 		/* message */
 		thislen = snprintf(msgbuf, MAXMSGBUF, "M%s", message);
+		thislen = Min(thislen, MAXMSGBUF);
 		memcpy(data +len, msgbuf, thislen+1);
 		len += thislen + 1;
 
@@ -2424,6 +2435,7 @@ void pool_send_error_message(POOL_CONNECTION *frontend, int protoMajor,
 		if (*detail != '\0')
 		{
 			thislen = snprintf(msgbuf, MAXMSGBUF, "D%s", detail);
+			thislen = Min(thislen, MAXMSGBUF);
 			memcpy(data +len, msgbuf, thislen+1);
 			len += thislen + 1;
 		}
@@ -2432,17 +2444,20 @@ void pool_send_error_message(POOL_CONNECTION *frontend, int protoMajor,
 		if (*hint != '\0')
 		{
 			thislen = snprintf(msgbuf, MAXMSGBUF, "H%s", hint);
+			thislen = Min(thislen, MAXMSGBUF);
 			memcpy(data +len, msgbuf, thislen+1);
 			len += thislen + 1;
 		}
 
 		/* file */
 		thislen = snprintf(msgbuf, MAXMSGBUF, "F%s", file);
+		thislen = Min(thislen, MAXMSGBUF);
 		memcpy(data +len, msgbuf, thislen+1);
 		len += thislen + 1;
 
 		/* line */
 		thislen = snprintf(msgbuf, MAXMSGBUF, "L%d", line);
+		thislen = Min(thislen, MAXMSGBUF);
 		memcpy(data +len, msgbuf, thislen+1);
 		len += thislen + 1;
 


[parent: f8281f175036]