From: Tom Lane <tgl@sss.pgh.pa.us>
To: Justin Pryzby <pryzby@telsasoft.com>
cc: pgsql-hackers@lists.postgresql.org
Subject: Re: pg17.3 PQescapeIdentifier() ignores len
In-reply-to: <Z64jD3u46gObCo1p@pryzbyj2023>
References: <Z64jD3u46gObCo1p@pryzbyj2023>
Comments: In-reply-to Justin Pryzby <pryzby@telsasoft.com>
	message dated "Thu, 13 Feb 2025 10:51:27 -0600"
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0"
Content-ID: <3718284.1739473173.0@sss.pgh.pa.us>
Date: Thu, 13 Feb 2025 14:00:09 -0500
Message-ID: <3718360.1739473209@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3718360.1739473209%40sss.pgh.pa.us>
Precedence: bulk

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3718284.1739473173.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable

Justin Pryzby <pryzby@telsasoft.com> writes:
> The fprintf suggests that since 5dc1e42b4 PQescapeIdentifier ignores its=
 len.

Ugh, yes.  Need something like the attached.

FTR, 5dc1e42b4 et al were quite subtle patches done under extreme time
pressure.  I wonder if they have any other issues.  More eyes on those
patches would be welcome, now that they are public.

			regards, tom lane


------- =_aaaaaaaaaa0
Content-Type: text/x-diff;
	name="fix-PQescapeInternal-ignores-len-parameter.patch";
	charset="us-ascii"
Content-ID: <3718284.1739473173.2@sss.pgh.pa.us>
Content-Description: fix-PQescapeInternal-ignores-len-parameter.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/src/interfaces/libpq/fe-exec.c b/src/interfaces/libpq/fe-exec=
.c
index e97ad02542..120d4d032e 100644
--- a/src/interfaces/libpq/fe-exec.c
+++ b/src/interfaces/libpq/fe-exec.c
@@ -4224,7 +4224,7 @@ PQescapeInternal(PGconn *conn, const char *str, size=
_t len, bool as_ident)
 	char	   *rp;
 	int			num_quotes =3D 0; /* single or double, depending on as_ident */
 	int			num_backslashes =3D 0;
-	size_t		input_len =3D strlen(str);
+	size_t		input_len =3D strnlen(str, len);
 	size_t		result_size;
 	char		quote_char =3D as_ident ? '"' : '\'';
 	bool		validated_mb =3D false;
@@ -4274,7 +4274,7 @@ PQescapeInternal(PGconn *conn, const char *str, size=
_t len, bool as_ident)
 			if (!validated_mb)
 			{
 				if (pg_encoding_verifymbstr(conn->client_encoding, s, remaining)
-					!=3D strlen(s))
+					!=3D remaining)
 				{
 					libpq_append_conn_error(conn, "invalid multibyte character");
 					return NULL;

------- =_aaaaaaaaaa0--