diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2007-08-21 02:40:33 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2007-08-21 02:40:33 +0000 |
| commit | 42110a6a6a3f15ea1ca1e81fbf3417322bdecff7 (patch) | |
| tree | 8aa904744a4322698e9249a8a84d61a246ef4b42 /src | |
| parent | 7824c695ac3168c8d0ea622b9e4c76bc88c71362 (diff) | |
| download | postgresql-42110a6a6a3f15ea1ca1e81fbf3417322bdecff7.tar.gz postgresql-42110a6a6a3f15ea1ca1e81fbf3417322bdecff7.zip | |
Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the
byte after the last full byte of the bit array, regardless of whether that
byte was part of the valid data or not. Found by buildfarm testing.
Thanks to Stefan Kaltenbrunner for nailing down the cause.
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/utils/adt/varbit.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/backend/utils/adt/varbit.c b/src/backend/utils/adt/varbit.c index 00527c45f18..0143e0aa9c6 100644 --- a/src/backend/utils/adt/varbit.c +++ b/src/backend/utils/adt/varbit.c @@ -9,7 +9,7 @@ * Portions Copyright (c) 1994, Regents of the University of California * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/utils/adt/varbit.c,v 1.37 2003/09/25 06:58:05 petere Exp $ + * $Header: /cvsroot/pgsql/src/backend/utils/adt/varbit.c,v 1.37.2.1 2007/08/21 02:40:33 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -430,8 +430,9 @@ varbit_out(PG_FUNCTION_ARGS) result = (char *) palloc(len + 1); sp = VARBITS(s); r = result; - for (i = 0; i < len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++) + for (i = 0; i <= len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++) { + /* print full bytes */ x = *sp; for (k = 0; k < BITS_PER_BYTE; k++) { @@ -439,11 +440,15 @@ varbit_out(PG_FUNCTION_ARGS) x <<= 1; } } - x = *sp; - for (k = i; k < len; k++) + if (i < len) { - *r++ = (x & BITHIGH) ? '1' : '0'; - x <<= 1; + /* print the last partial byte */ + x = *sp; + for (k = i; k < len; k++) + { + *r++ = (x & BITHIGH) ? '1' : '0'; + x <<= 1; + } } *r = '\0'; |