diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2004-05-12 22:38:44 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2004-05-12 22:38:44 +0000 |
| commit | 4d924bdb462106f152b28ab7d66fcf5e5253e587 (patch) | |
| tree | cd3b4e2d59c45349d13f73b9612bb97786014b38 /src/backend/utils/adt/geo_ops.c | |
| parent | 0a54441cbfdecbf4615a0c0ea537d458587056fe (diff) | |
| download | postgresql-4d924bdb462106f152b28ab7d66fcf5e5253e587.tar.gz postgresql-4d924bdb462106f152b28ab7d66fcf5e5253e587.zip | |
Tighten up overflow check in path_recv, pursuant to code review inspired
by Ken Ashcraft's report. I think there is no actual bug here since if
the int32 value does wrap a little bit, palloc will still reject it.
Still it's better that the code be obviously correct.
Diffstat (limited to 'src/backend/utils/adt/geo_ops.c')
| -rw-r--r-- | src/backend/utils/adt/geo_ops.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/utils/adt/geo_ops.c b/src/backend/utils/adt/geo_ops.c index e962823e5a7..4236be5471f 100644 --- a/src/backend/utils/adt/geo_ops.c +++ b/src/backend/utils/adt/geo_ops.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.83 2003/11/29 19:51:58 pgsql Exp $ + * $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.84 2004/05/12 22:38:44 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -1383,7 +1383,7 @@ path_recv(PG_FUNCTION_ARGS) closed = pq_getmsgbyte(buf); npts = pq_getmsgint(buf, sizeof(int32)); - if (npts < 0 || npts >= (int32) (INT_MAX / sizeof(Point))) + if (npts < 0 || npts >= (int32) ((INT_MAX - offsetof(PATH, p[0])) / sizeof(Point))) ereport(ERROR, (errcode(ERRCODE_INVALID_BINARY_REPRESENTATION), errmsg("invalid number of points in external \"path\" value"))); |