found another overrun

Started by Maurice Gittensabout 28 years ago2 messageshackers
Jump to latest
#1Maurice Gittens
mgittens@david.gits.nl

Hi,
This simple patch to catalog/pg_type.c fixes a buffer overrun.
It was detected by Electric Fence and triggered by statements like:

SELECT * into table t from pg_database;

The system would crash on a memmove call in DataFile() with arguments like this:

memmove(0x0, 0x0, 0);

Here's the patch.

320a321

NameData name;

390c391,392
< values[i++] = PointerGetDatum(typeName); /* 1 */
---

namestrcpy(&name,typeName);
values[i++] = NameGetDatum(&name); /* 1 */

After applying the patch the problem goes away.

I'll try to make all the buffer overruns detected by Electric Fence
during the regression test on my Linux system go away -:).
Debugging is a nice way to learn about a system isn't it?

With regards from Maurice.

#2Bruce Momjian
bruce@momjian.us
In reply to: Maurice Gittens (#1)
Re: [HACKERS] found another overrun

Patch applied.

Hi,
This simple patch to catalog/pg_type.c fixes a buffer overrun.
It was detected by Electric Fence and triggered by statements like:

SELECT * into table t from pg_database;

The system would crash on a memmove call in DataFile() with arguments like this:

memmove(0x0, 0x0, 0);

Here's the patch.

320a321

NameData name;

390c391,392
< values[i++] = PointerGetDatum(typeName); /* 1 */
---

namestrcpy(&name,typeName);
values[i++] = NameGetDatum(&name); /* 1 */

After applying the patch the problem goes away.

I'll try to make all the buffer overruns detected by Electric Fence
during the regression test on my Linux system go away -:).
Debugging is a nice way to learn about a system isn't it?

With regards from Maurice.

-- 
Bruce Momjian                          |  830 Blythe Avenue
maillist@candle.pha.pa.us              |  Drexel Hill, Pennsylvania 19026
  +  If your life is a hard drive,     |  (610) 353-9879(w)
  +  Christ can be your backup.        |  (610) 853-3000(h)