pgpool2.git / summary / log / commit / refs

commit    fee520c03c3d977553f9cfb5d470995c3556ea8c
Author:   Tatsuo Ishii <ishii@sraoss.co.jp>
Date:     Sat Jul 06 23:03:02 2019 +0000

    Fix buffer overrun in Pgversion().
    
    Also enhance comments.


 src/protocol/child.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/protocol/child.c b/src/protocol/child.c
index c106f8b58..6d49c2c70 100644
--- a/src/protocol/child.c
+++ b/src/protocol/child.c
@@ -2473,7 +2473,7 @@ static int opt_sort(const void *a, const void *b)
  *
  * Note:
  * Must be called while query context already exists.
- * If there's something goes wrong, this raises FATA. So never returns to caller.
+ * If there's something goes wrong, this raises FATAL. So never returns to caller.
  *
  */
 PGVersion *
@@ -2530,14 +2530,17 @@ Pgversion(POOL_CONNECTION_POOL * backend)
 			(errmsg("Pgversion: version string: %s", result)));
 
 	/*
-	 * Extract major version number.
-	 * We create major version as "version" * 10.  For example, for V10, major
-	 * will be 100, for V9.6 major will be 96, and so on.
+	 * Extract major version number.  We create major version as "version" *
+	 * 10.  For example, for V10, the major version number will be 100, for
+	 * V9.6 it will be 96, and so on.  For alpha or beta version, the version
+	 * string could be something like "12beta1". In this case we assume that
+	 * atoi(3) is smart enough to stop at the first character which is not a
+	 * valid digit (in our case 'b')). So "12beta1" should be converted to 12.
 	 */
 	p = strchr(result, ' ');
 	p++;
 	i = 0;
-	while (i < VERSION_BUF_SIZE && p && *p != '.')
+	while (i < VERSION_BUF_SIZE - 1 && p && *p != '.')
 	{
 		buf[i++] = *p++;
 	}
@@ -2566,7 +2569,7 @@ Pgversion(POOL_CONNECTION_POOL * backend)
 	{
 		p++;
 		i = 0;
-		while (i < VERSION_BUF_SIZE && p && *p != '.' && *p != ' ')
+		while (i < VERSION_BUF_SIZE -1 && p && *p != '.' && *p != ' ')
 		{
 			buf[i++] = *p++;
 		}
@@ -2582,7 +2585,7 @@ Pgversion(POOL_CONNECTION_POOL * backend)
 	 */
 	p++;
 	i = 0;
-	while (i < VERSION_BUF_SIZE && p && *p != '.' && *p != ' ')
+	while (i < VERSION_BUF_SIZE -1 && p && *p != '.' && *p != ' ')
 	{
 		buf[i++] = *p++;
 	}


[parent: dd0097dc3620]