diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2004-05-12 22:39:00 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2004-05-12 22:39:00 +0000 |
| commit | 65924e6cc6048667a6d1c0ddf33cce76881b226b (patch) | |
| tree | c5829424a451048f7d5e9d3a2b11cda5a3fcb917 | |
| parent | 5e027b19cd79c944a3fb1b9024745d563c9e57cb (diff) | |
| download | postgresql-65924e6cc6048667a6d1c0ddf33cce76881b226b.tar.gz postgresql-65924e6cc6048667a6d1c0ddf33cce76881b226b.zip | |
Tighten up overflow check in path_recv, pursuant to code review inspired
by Ken Ashcraft's report. I think there is no actual bug here since if
the int32 value does wrap a little bit, palloc will still reject it.
Still it's better that the code be obviously correct.
| -rw-r--r-- | src/backend/utils/adt/geo_ops.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/utils/adt/geo_ops.c b/src/backend/utils/adt/geo_ops.c index 0e80190958d..19de68af870 100644 --- a/src/backend/utils/adt/geo_ops.c +++ b/src/backend/utils/adt/geo_ops.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/utils/adt/geo_ops.c,v 1.82 2003/09/29 00:05:25 petere Exp $ + * $Header: /cvsroot/pgsql/src/backend/utils/adt/geo_ops.c,v 1.82.2.1 2004/05/12 22:39:00 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -1383,7 +1383,7 @@ path_recv(PG_FUNCTION_ARGS) closed = pq_getmsgbyte(buf); npts = pq_getmsgint(buf, sizeof(int32)); - if (npts < 0 || npts >= (int32) (INT_MAX / sizeof(Point))) + if (npts < 0 || npts >= (int32) ((INT_MAX - offsetof(PATH, p[0])) / sizeof(Point))) ereport(ERROR, (errcode(ERRCODE_INVALID_BINARY_REPRESENTATION), errmsg("invalid number of points in external \"path\" value"))); |