diff options
Diffstat (limited to 'contrib/hstore/hstore_io.c')
| -rw-r--r-- | contrib/hstore/hstore_io.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/contrib/hstore/hstore_io.c b/contrib/hstore/hstore_io.c index 772a5ca5d51..3e6feecc170 100644 --- a/contrib/hstore/hstore_io.c +++ b/contrib/hstore/hstore_io.c @@ -13,6 +13,7 @@ #include "utils/builtins.h" #include "utils/json.h" #include "utils/lsyscache.h" +#include "utils/memutils.h" #include "utils/typcache.h" #include "hstore.h" @@ -439,6 +440,11 @@ hstore_recv(PG_FUNCTION_ARGS) PG_RETURN_POINTER(out); } + if (pcount < 0 || pcount > MaxAllocSize / sizeof(Pairs)) + ereport(ERROR, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("number of pairs (%d) exceeds the maximum allowed (%d)", + pcount, (int) (MaxAllocSize / sizeof(Pairs))))); pairs = palloc(pcount * sizeof(Pairs)); for (i = 0; i < pcount; ++i) @@ -554,6 +560,13 @@ hstore_from_arrays(PG_FUNCTION_ARGS) TEXTOID, -1, false, 'i', &key_datums, &key_nulls, &key_count); + /* see discussion in hstoreArrayToPairs() */ + if (key_count > MaxAllocSize / sizeof(Pairs)) + ereport(ERROR, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("number of pairs (%d) exceeds the maximum allowed (%d)", + key_count, (int) (MaxAllocSize / sizeof(Pairs))))); + /* value_array might be NULL */ if (PG_ARGISNULL(1)) @@ -676,6 +689,13 @@ hstore_from_array(PG_FUNCTION_ARGS) count = in_count / 2; + /* see discussion in hstoreArrayToPairs() */ + if (count > MaxAllocSize / sizeof(Pairs)) + ereport(ERROR, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("number of pairs (%d) exceeds the maximum allowed (%d)", + count, (int) (MaxAllocSize / sizeof(Pairs))))); + pairs = palloc(count * sizeof(Pairs)); for (i = 0; i < count; ++i) @@ -807,6 +827,7 @@ hstore_from_record(PG_FUNCTION_ARGS) my_extra->ncolumns = ncolumns; } + Assert(ncolumns <= MaxTupleAttributeNumber); /* thus, no overflow */ pairs = palloc(ncolumns * sizeof(Pairs)); if (rec) |