Fix possible dereference null pointer (PQprint)

Started by Ranier Vilelaover 1 year ago3 messages
#1Ranier Vilela
ranier.vf@gmail.com
1 attachment(s)

Hi.

In the function *PQprint*, the variable po->fieldName
can be NULL.
See the checks a few lines up.

for (numFieldName = 0;
po->fieldName && po->fieldName[numFieldName];
numFieldName++)

So, I think that must be checked, when used,
in the loop below.

best regards,
Ranier Vilela

Attachments:

fix-possible-dereference-null-pointer-PQprint.patchapplication/octet-stream; name=fix-possible-dereference-null-pointer-PQprint.patchDownload
diff --git a/src/interfaces/libpq/fe-print.c b/src/interfaces/libpq/fe-print.c
index df95f059ef..d0c29ab838 100644
--- a/src/interfaces/libpq/fe-print.c
+++ b/src/interfaces/libpq/fe-print.c
@@ -120,7 +120,7 @@ PQprint(FILE *fout, const PGresult *res, const PQprintOpt *po)
 		for (j = 0; j < nFields; j++)
 		{
 			int			len;
-			const char *s = (j < numFieldName && po->fieldName[j][0]) ?
+			const char *s = (j < numFieldName && po->fieldName && po->fieldName[j]) ?
 				po->fieldName[j] : PQfname(res, j);
 
 			fieldNames[j] = s;
#2Daniel Gustafsson
daniel@yesql.se
In reply to: Ranier Vilela (#1)
Re: Fix possible dereference null pointer (PQprint)

On 27 May 2024, at 16:52, Ranier Vilela <ranier.vf@gmail.com> wrote:

In the function *PQprint*, the variable po->fieldName can be NULL.

Yes.

See the checks a few lines up.

Indeed, let's check it.

for (numFieldName = 0;
po->fieldName && po->fieldName[numFieldName];
numFieldName++)
;
for (j = 0; j < nFields; j++)
{
int len;
const char *s = (j < numFieldName && po->fieldName[j][0]) ?
po->fieldName[j] : PQfname(res, j);

If po->fieldName is NULL then numFieldName won't be incremented and will remain
zero. In the check you reference we check (j < numFieldName) which will check
the j in the range 0..nFields for being less than zero. The code thus does
seem quite correct to me.

--
Daniel Gustafsson

#3Ranier Vilela
ranier.vf@gmail.com
In reply to: Daniel Gustafsson (#2)
Re: Fix possible dereference null pointer (PQprint)

Em sex., 31 de mai. de 2024 às 05:03, Daniel Gustafsson <daniel@yesql.se>
escreveu:

On 27 May 2024, at 16:52, Ranier Vilela <ranier.vf@gmail.com> wrote:

In the function *PQprint*, the variable po->fieldName can be NULL.

Yes.

See the checks a few lines up.

Indeed, let's check it.

for (numFieldName = 0;
po->fieldName && po->fieldName[numFieldName];
numFieldName++)
;
for (j = 0; j < nFields; j++)
{
int len;
const char *s = (j < numFieldName && po->fieldName[j][0]) ?
po->fieldName[j] : PQfname(res, j);

If po->fieldName is NULL then numFieldName won't be incremented and will
remain
zero. In the check you reference we check (j < numFieldName) which will
check
the j in the range 0..nFields for being less than zero. The code thus does
seem quite correct to me.

You are completely correct. My bad.

Thank you Daniel.

best regards,
Ranier Vilela