pgpool2.git / summary / log / commit / refs

commit    5c53a399e4d20ea4850ccd8f3409000eadcc7bd4
Author:   Tatsuo Ishii <ishii at sraoss.co.jp>
Date:     Wed Dec 16 07:27:14 2009 +0000

    Fix sloppy coding of detect_erorr(). Check memory allocation error,
    check buffer overrun error.


 pool_process_query.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pool_process_query.c b/pool_process_query.c
index df0d387df..cc3572d2c 100644
--- a/pool_process_query.c
+++ b/pool_process_query.c
@@ -3999,8 +3999,23 @@ static int detect_error(POOL_CONNECTION *backend, char *error_code, int major, c
 
 			len = ntohl(len) - 4;
 			str = malloc(len);
+
+			if (!str)
+			{
+				pool_error("detect_error: malloc failed");
+				return POOL_END;
+			}
+
 			pool_read(backend, str, len);
 			readlen += len;
+
+			if (readlen >= sizeof(buf))
+			{
+				pool_error("detect_error: not enough buffer space");
+				free(str);
+				return POOL_END;
+			}
+
 			memcpy(p, str, len);
 
 			/*
@@ -4024,6 +4039,13 @@ static int detect_error(POOL_CONNECTION *backend, char *error_code, int major, c
 		{
 			str = pool_read_string(backend, &len, 0);
 			readlen += len;
+
+			if (readlen >= sizeof(buf))
+			{
+				pool_error("detect_error: not enough buffer space");
+				return POOL_END;
+			}
+
 			memcpy(p, str, len);
 		}
 	}


[parent: 78921f3bcbab]