public inbox for [email protected]  

help / color / mirror / Atom feed

From: Ranier Vilela <[email protected]>
To: Pg Hackers <[email protected]>
Subject: Avoid possible overflow (src/port/bsearch_arg.c)
Date: Tue, 8 Oct 2024 16:09:00 -0300
Message-ID: <CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com> (raw)

Hi.

The port function *bsearch_arg* mimics the C function
*bsearch*.

The API signature is:
void *
bsearch_arg(const void *key, const void *base0,
size_t nmemb, size_t size,
int (*compar) (const void *, const void *, void *),
void *arg)

So, the parameter *nmemb* is size_t.
Therefore, a call with nmemb greater than INT_MAX is possible.

Internally the code uses the *int* type to iterate through the number of
members, which makes overflow possible.

Trivial fix attached.

best regards,
Ranier Vilela


Attachments:

  [application/octet-stream] avoid-possible-overflow-bsearch_arg.patch (393B, ../CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com/3-avoid-possible-overflow-bsearch_arg.patch)
  download | inline diff:
diff --git a/src/port/bsearch_arg.c b/src/port/bsearch_arg.c
index f0de467bee..e0446a9f07 100644
--- a/src/port/bsearch_arg.c
+++ b/src/port/bsearch_arg.c
@@ -58,8 +58,8 @@ bsearch_arg(const void *key, const void *base0,
 			void *arg)
 {
 	const char *base = (const char *) base0;
-	int			lim,
-				cmp;
+	size_t		lim;
+	int			cmp;
 	const void *p;
 
 	for (lim = nmemb; lim != 0; lim >>= 1)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected]
  Subject: Re: Avoid possible overflow (src/port/bsearch_arg.c)
  In-Reply-To: <CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox