From: tgl@postgresql.org
To: pgsql-committers@postgresql.org
Subject: pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator
Date: Fri, 10 Jul 2009 00:32:12 +0000 (UTC)
Message-ID: <20090710003212.95DAE753336@cvs.postgresql.org> (raw)
Log Message:
-----------
Fix xslt_process() to ensure that it inserts a NULL terminator after the
last pair of parameter name/value strings, even when there are MAXPARAMS
of them. Aboriginal bug in contrib/xml2, noted while studying bug #4912
(though I'm not sure whether there's something else involved in that
report).
This might be thought a security issue, since it's a potential backend
crash; but considering that untrustworthy users shouldn't be allowed
to get their hands on xslt_process() anyway, it's probably not worth
getting excited about.
Tags:
----
REL8_3_STABLE
Modified Files:
--------------
pgsql/contrib/xml2:
xslt_proc.c (r1.9 -> r1.9.2.1)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/contrib/xml2/xslt_proc.c?r1=1.9&r2=1.9.2.1)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@postgresql.org
Subject: Re: pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator
In-Reply-To: <20090710003212.95DAE753336@cvs.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox