postgres.git / summary / log / commit / refs

commit    bbb7e05c32fb6e1a67dbd3eeaed97c106c277d95
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Tue Aug 21 02:40:18 2007 +0000
First released in: 8.3.0, 7.3.20, 7.4.18, 8.0.14, 8.1.10, 8.2.5

    Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the
    byte after the last full byte of the bit array, regardless of whether that
    byte was part of the valid data or not.  Found by buildfarm testing.
    Thanks to Stefan Kaltenbrunner for nailing down the cause.


 src/backend/utils/adt/varbit.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/backend/utils/adt/varbit.c b/src/backend/utils/adt/varbit.c
index 7dbbed16f69..389749961c6 100644
--- a/src/backend/utils/adt/varbit.c
+++ b/src/backend/utils/adt/varbit.c
@@ -9,7 +9,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/adt/varbit.c,v 1.47 2005/10/15 02:49:30 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/adt/varbit.c,v 1.47.2.1 2007/08/21 02:40:18 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -472,8 +472,9 @@ varbit_out(PG_FUNCTION_ARGS)
 	result = (char *) palloc(len + 1);
 	sp = VARBITS(s);
 	r = result;
-	for (i = 0; i < len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
+	for (i = 0; i <= len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
 	{
+		/* print full bytes */
 		x = *sp;
 		for (k = 0; k < BITS_PER_BYTE; k++)
 		{
@@ -481,11 +482,15 @@ varbit_out(PG_FUNCTION_ARGS)
 			x <<= 1;
 		}
 	}
-	x = *sp;
-	for (k = i; k < len; k++)
+	if (i < len)
 	{
-		*r++ = (x & BITHIGH) ? '1' : '0';
-		x <<= 1;
+		/* print the last partial byte */
+		x = *sp;
+		for (k = i; k < len; k++)
+		{
+			*r++ = (x & BITHIGH) ? '1' : '0';
+			x <<= 1;
+		}
 	}
 	*r = '\0';
 


[parent: d8cb5391c21d]