Subject: off by 1!

From: [email-masked] (Postgres System User)
Date: Tue, 1 Sep 92 10:13:14 -0700

Jeff
The following example is one of those cases about which we spoke.
There are/were? still places where Names are copied using strcpy().
If a Name is copied via strcpy() into a struct that has only
allowed char16 (sizeof(NameData)) for a Name and that Name
should happen to be of length sizeof(NameData), we step on the
first byte of the structure's next element!

>From creatinh.c:
--- 178,186 ----
        elog(WARN, "the relation name %s is > %d characters long", relname,
  	   sizeof(NameData));
  
!     relationName = (Name)palloc(sizeof (NameData)+1);
!     bzero(relationName, sizeof (NameData)+1);
!     strncpy( &(relationName->data[0]), relname, sizeof (NameData) );
  
Perhaps not as good but safer may be something like:
    relationName = (Name) palloc(sizeof (NameData));
    strncpy ((char *) relationName, relname, sizeof(NameData));
    ((char *) relationName)[sizeof(NameData) - 1] = NULLCHAR;
where NULLCHAR is defined as '\0' in c.h or postgres.h.