diff options
| author | Neil Conway <neilc@samurai.com> | 2005-01-21 00:31:21 +0000 |
|---|---|---|
| committer | Neil Conway <neilc@samurai.com> | 2005-01-21 00:31:21 +0000 |
| commit | 3b01217d7dc1441bdab0d07f7b041a2851b57008 (patch) | |
| tree | 75b6a35b29294e1f7afee1dd9f68136b2f0ee412 /src | |
| parent | ce69fa976888f293c115c8c85a577607058156ee (diff) | |
| download | postgresql-3b01217d7dc1441bdab0d07f7b041a2851b57008.tar.gz postgresql-3b01217d7dc1441bdab0d07f7b041a2851b57008.zip | |
Prevent overrunning a heap-allocated buffer if more than 1024 parameters
to a refcursor declaration are specified. This is a minimally-invasive fix
for the buffer overrun -- a more thorough cleanup will be checked into
HEAD.
Diffstat (limited to 'src')
| -rw-r--r-- | src/pl/plpgsql/src/gram.y | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/pl/plpgsql/src/gram.y b/src/pl/plpgsql/src/gram.y index 22bd1ef8fd7..e630a9d9ebe 100644 --- a/src/pl/plpgsql/src/gram.y +++ b/src/pl/plpgsql/src/gram.y @@ -4,7 +4,7 @@ * procedural language * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/pl/plpgsql/src/gram.y,v 1.48 2003/10/30 17:18:55 tgl Exp $ + * $Header: /cvsroot/pgsql/src/pl/plpgsql/src/gram.y,v 1.48.2.1 2005/01/21 00:31:21 neilc Exp $ * * This software is copyrighted by Jan Wieck - Hamburg. * @@ -512,6 +512,10 @@ decl_cursor_arglist : decl_cursor_arg { int i = $1->nfields++; + /* Guard against overflowing the array on malicious input */ + if (i >= 1024) + yyerror("too many parameters specified for refcursor"); + $1->fieldnames[i] = $3->refname; $1->varnos[i] = $3->varno; |