From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Incorrect usage of strtol, atoi for non-numeric junk inputs
Date: Fri, 4 Jun 2021 11:28:04 -0400
Message-ID: <202106041528.5gt6owi2kq6m@alvherre.pgsql> (raw)
In-Reply-To: <CALj2ACWddWd6Vms-MqhGdqcj6Z4V2qA9eUas1k4veb1yPF=dag@mail.gmail.com>
On 2021-Jun-04, Bharath Rupireddy wrote:
> On Thu, May 27, 2021 at 3:05 AM Alvaro Herrera <alvherre@alvh.no-ip.org> wrote:
> > Hi, how is this related to
> > https://postgr.es/m/20191028012000.GA59064@begriffs.com ?
>
> Thanks. The proposed approach there was to implement postgres's own
> strtol i.e. string parsing, conversion to integers and use it in the
> places where atoi is being used. I'm not sure how far that can go.
> What I'm proposing here is to use strtol inplace of atoi to properly
> detect errors in case of inputs like '1211efe', '-14adc' and so on as
> atoi can't detect such errors. Thoughts?
Well, if you scroll back to Surafel's initial submission in that thread,
it looks very similar in spirit to what you have here.
Another thing I just noticed which I hadn't realized is that Joe
Nelson's patch depends on Fabien Coelho's patch in this other thread,
https://www.postgresql.org/message-id/flat/alpine.DEB.2.21.1904201223040.29102@lancre
which was closed as returned-with-feedback, I suppose mostly due to
exhaustion/frustration at the lack of progress/interest.
I would suggest that the best way forward in this area is to rebase both
there patches on current master.
--
Álvaro Herrera Valdivia, Chile
"La virtud es el justo medio entre dos defectos" (Aristóteles)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: alvherre@alvh.no-ip.org, bharath.rupireddyforpostgres@gmail.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Incorrect usage of strtol, atoi for non-numeric junk inputs
In-Reply-To: <202106041528.5gt6owi2kq6m@alvherre.pgsql>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox