pgpool2.git / summary / log / commit / refs

commit    acf83e8f2675ade92222e3fbc4d62eadf8da5581
Author:   Tatsuo Ishii <ishii@postgresql.org>
Commit:   Muhammad Usama <m.usama@gmail.com>
Date:     Tue Nov 19 07:18:39 2013 +0000

    Fix buffer overrun bug and resource leak bug of parse_copy_data().
    
    Per Coverity report 1111427 "Out-of-bounds write" and 1111453
    "Resource leak".


 src/protocol/pool_process_query.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/src/protocol/pool_process_query.c b/src/protocol/pool_process_query.c
index a28cde2e4..eac35de66 100644
--- a/src/protocol/pool_process_query.c
+++ b/src/protocol/pool_process_query.c
@@ -4031,14 +4031,9 @@ parse_copy_data(char *buf, int len, char delimiter, int col_id)
 		if (buf[i] == '\\' && i != len - 2) /* escape */
 		{
 			if (buf[i+1] == delimiter)
-			{
 				i++;
-				str[j++] = buf[i];
-			}
-			else
-			{
-				str[j++] = buf[i];
-			}
+
+			str[j++] = buf[i];
 		}
 		else if (buf[i] == delimiter) /* delimiter */
 		{
@@ -4061,10 +4056,11 @@ parse_copy_data(char *buf, int len, char delimiter, int col_id)
 	if (field == col_id)
 	{
 		str[j] = '\0';
-		p = malloc(j);
+		p = malloc(j+1);
 		if (p == NULL)
 		{
 			pool_error("parse_copy_data: malloc failed");
+			free(str);
 			return NULL;
 		}
 		strcpy(p, str);
@@ -4086,7 +4082,7 @@ void query_ps_status(char *query, POOL_CONNECTION_POOL *backend)
 		return;
 
 	sp = MASTER_CONNECTION(backend)->sp;
-	i = snprintf(psbuf, sizeof(psbuf), "%s %s %s ",
+	i = snprintf(psbuf, sizeof(psbuf) - 1, "%s %s %s ",
 				 sp->user, sp->database, remote_ps_data);
 
 	/* skip spaces */


[parent: 1a8056dce0be]