aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorTom Lane <tgl@sss.pgh.pa.us>2023-03-01 11:30:17 -0500
committerTom Lane <tgl@sss.pgh.pa.us>2023-03-01 11:30:17 -0500
commiteae09137d53ecb9cb4c1ba7624723f1c1cbebeec (patch)
treee245ae2946fd784b5ace7772ac6937f06c7544cb /src
parentb5784e6a5ecd81468462a91486266adc87d03110 (diff)
downloadpostgresql-eae09137d53ecb9cb4c1ba7624723f1c1cbebeec.tar.gz
postgresql-eae09137d53ecb9cb4c1ba7624723f1c1cbebeec.zip
Avoid fetching one past the end of translate()'s "to" parameter.
This is usually harmless, but if you were very unlucky it could provoke a segfault due to the "to" string being right up against the end of memory. Found via valgrind testing (so we might've found it earlier, except that our regression tests lacked any exercise of translate()'s deletion feature). Fix by switching the order of the test-for-end-of-string and advance-pointer steps. While here, compute "to_ptr + tolen" just once. (Smarter compilers might figure that out for themselves, but let's just make sure.) Report and fix by Daniil Anisimov, in bug #17816. Discussion: https://postgr.es/m/17816-70f3d2764e88a108@postgresql.org
Diffstat (limited to 'src')
-rw-r--r--src/backend/utils/adt/oracle_compat.c12
-rw-r--r--src/test/regress/expected/strings.out6
-rw-r--r--src/test/regress/sql/strings.sql1
3 files changed, 14 insertions, 5 deletions
diff --git a/src/backend/utils/adt/oracle_compat.c b/src/backend/utils/adt/oracle_compat.c
index 018e8c93428..6a5ce1cc102 100644
--- a/src/backend/utils/adt/oracle_compat.c
+++ b/src/backend/utils/adt/oracle_compat.c
@@ -800,7 +800,8 @@ translate(PG_FUNCTION_ARGS)
text *to = PG_GETARG_TEXT_PP(2);
text *result;
char *from_ptr,
- *to_ptr;
+ *to_ptr,
+ *to_end;
char *source,
*target;
int m,
@@ -822,6 +823,7 @@ translate(PG_FUNCTION_ARGS)
from_ptr = VARDATA_ANY(from);
tolen = VARSIZE_ANY_EXHDR(to);
to_ptr = VARDATA_ANY(to);
+ to_end = to_ptr + tolen;
/*
* The worst-case expansion is to substitute a max-length character for a
@@ -856,16 +858,16 @@ translate(PG_FUNCTION_ARGS)
}
if (i < fromlen)
{
- /* substitute */
+ /* substitute, or delete if no corresponding "to" character */
char *p = to_ptr;
for (i = 0; i < from_index; i++)
{
- p += pg_mblen(p);
- if (p >= (to_ptr + tolen))
+ if (p >= to_end)
break;
+ p += pg_mblen(p);
}
- if (p < (to_ptr + tolen))
+ if (p < to_end)
{
len = pg_mblen(p);
memcpy(target, p, len);
diff --git a/src/test/regress/expected/strings.out b/src/test/regress/expected/strings.out
index 0f95b9400b6..b72120d48b2 100644
--- a/src/test/regress/expected/strings.out
+++ b/src/test/regress/expected/strings.out
@@ -2506,6 +2506,12 @@ SELECT translate('12345', '14', 'ax');
a23x5
(1 row)
+SELECT translate('12345', '134', 'a');
+ translate
+-----------
+ a25
+(1 row)
+
SELECT ascii('x');
ascii
-------
diff --git a/src/test/regress/sql/strings.sql b/src/test/regress/sql/strings.sql
index 8c379182cb9..fd4f1f674aa 100644
--- a/src/test/regress/sql/strings.sql
+++ b/src/test/regress/sql/strings.sql
@@ -813,6 +813,7 @@ SELECT ltrim('zzzytrim', 'xyz');
SELECT translate('', '14', 'ax');
SELECT translate('12345', '14', 'ax');
+SELECT translate('12345', '134', 'a');
SELECT ascii('x');
SELECT ascii('');