pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #14468: One byte buffer overlow in quote_literal_cstr()
2+ messages / 2 participants
[nested] [flat]
* BUG #14468: One byte buffer overlow in quote_literal_cstr()
@ 2016-12-16 10:50 hlinnaka@iki.fi
2016-12-16 14:43 ` Re: BUG #14468: One byte buffer overlow in quote_literal_cstr() Alvaro Herrera <alvherre@2ndquadrant.com>
0 siblings, 1 reply; 2+ messages in thread
From: hlinnaka@iki.fi @ 2016-12-16 10:50 UTC (permalink / raw)
To: pgsql-bugs
The following bug has been logged on the website:
Bug reference: 14468
Logged by: Heikki Linnakangas
Email address: hlinnaka@iki.fi
PostgreSQL version: 9.6.1
Operating system: All
Description:
postgres=# select format('%L', E'\\');
WARNING: detected write past chunk end in ExprContext 0x55c65ff98fa8
format
--------
E'\\'
(1 row)
This was originally reported against Greenplum, at
https://github.com/greenplum-db/gpdb/issues/1301. The code there isn't quite
the same, but it turned out to be a shared bug.
Looking at quote_literal_cstr(), it simply doesn't take into account the
space needed for the NULL terminator, when it allocates the buffer. The fix
is a straightforward + 1 to the allocation. I'll go and do that shortly, and
backpatch.
--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #14468: One byte buffer overlow in quote_literal_cstr()
2016-12-16 10:50 BUG #14468: One byte buffer overlow in quote_literal_cstr() hlinnaka@iki.fi
@ 2016-12-16 14:43 ` Alvaro Herrera <alvherre@2ndquadrant.com>
0 siblings, 0 replies; 2+ messages in thread
From: Alvaro Herrera @ 2016-12-16 14:43 UTC (permalink / raw)
To: hlinnaka@iki.fi; +Cc: pgsql-bugs
hlinnaka@iki.fi wrote:
> Looking at quote_literal_cstr(), it simply doesn't take into account the
> space needed for the NULL terminator, when it allocates the buffer. The fix
> is a straightforward + 1 to the allocation. I'll go and do that shortly, and
> backpatch.
Hm, that's a bit confusing. I thought the +3 included the terminator,
but what it's actually for is the optional starting E; and the reason
quote_literal doesn't need similar patching it is that there is no
terminator 'cause it produces varlena. I would think this deserves a
comment ...
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2016-12-16 14:43 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-12-16 10:50 BUG #14468: One byte buffer overlow in quote_literal_cstr() hlinnaka@iki.fi
2016-12-16 14:43 ` Alvaro Herrera <alvherre@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox