From: hlinnaka@iki.fi
To: pgsql-bugs@postgresql.org
Subject: BUG #14468: One byte buffer overlow in quote_literal_cstr()
Date: Fri, 16 Dec 2016 10:50:01 +0000
Message-ID: <20161216105001.13334.42819@wrigleys.postgresql.org> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-bugs>
The following bug has been logged on the website:
Bug reference: 14468
Logged by: Heikki Linnakangas
Email address: hlinnaka@iki.fi
PostgreSQL version: 9.6.1
Operating system: All
Description:
postgres=# select format('%L', E'\\');
WARNING: detected write past chunk end in ExprContext 0x55c65ff98fa8
format
--------
E'\\'
(1 row)
This was originally reported against Greenplum, at
https://github.com/greenplum-db/gpdb/issues/1301. The code there isn't quite
the same, but it turned out to be a shared bug.
Looking at quote_literal_cstr(), it simply doesn't take into account the
space needed for the NULL terminator, when it allocates the buffer. The fix
is a straightforward + 1 to the allocation. I'll go and do that shortly, and
backpatch.
--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: hlinnaka@iki.fi
Subject: Re: BUG #14468: One byte buffer overlow in quote_literal_cstr()
In-Reply-To: <20161216105001.13334.42819@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox