pgpool2.git / summary / log / commit / refs

commit    b54f3c619dbebb46e71d431b5131d265b0864e48
Author:   Tatsuo Ishii <ishii@postgresql.org>
Date:     Fri Oct 17 13:15:03 2014 +0000

    Fix possible NULL pointer reference in ProcessFrontendResponse.
    
    Per coverity 1247717.


 src/protocol/pool_proto_modules.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/protocol/pool_proto_modules.c b/src/protocol/pool_proto_modules.c
index c38de418a..696c99124 100644
--- a/src/protocol/pool_proto_modules.c
+++ b/src/protocol/pool_proto_modules.c
@@ -2312,6 +2312,9 @@ POOL_STATUS ProcessFrontendResponse(POOL_CONNECTION *frontend,
 		len = ntohl(len) - 4;
 		if (len > 0)
 			bufp = pool_read2(frontend, len);
+		else if (len < 0)
+			ereport(ERROR,
+					(errmsg("frontend message length is less than 4 (kind: %c)", fkind)));
 	}
 	else
 	{
@@ -2343,13 +2346,21 @@ POOL_STATUS ProcessFrontendResponse(POOL_CONNECTION *frontend,
 	 * these protocol modules, pool_read2 maybe called and modify its
 	 * buffer contents.
 	 */
-	if(len > 0)
+	if (len > 0)
 	{
 		contents = palloc(len);
 		memcpy(contents, bufp, len);
 	}
 	else
-		contents = NULL;
+	{
+		/*
+		 * Set dummy content if len <= 0.
+		 * this happens only when protocol version is 2.
+		 */
+		contents = palloc(1);
+		memcpy(contents, "", 1);
+	}
+			
 	switch (fkind)
 	{
 		POOL_QUERY_CONTEXT *query_context;


[parent: 0ec00ad2b4a0]