mirrors
/
postgres
mirror of https://github.com/postgres/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix PQsetvalue() to avoid possible crash when adding a new tuple. 

PQsetvalue unnecessarily duplicated the logic in pqAddTuple, and didn't
duplicate it exactly either --- pqAddTuple does not care what is in the
tuple-pointer array positions beyond the last valid entry, whereas the
code in PQsetvalue assumed such positions would contain NULL.  This led
to possible crashes if PQsetvalue was applied to a PGresult that had
previously been enlarged with pqAddTuple, for instance one built from a
server query.  Fix by relying on pqAddTuple instead of duplicating logic,
and not assuming anything about the contents of res->tuples[res->ntups].

Back-patch to 8.4, where PQsetvalue was introduced.

Andrew Chernow
This commit is contained in:
Tom Lane 2011-07-21 12:24:14 -04:00
parent 0ce7676aa0
commit a9f0dbc39d
1 changed files with 4 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/interfaces/libpq/fe-exec.c
View File

@ -424,28 +424,8 @@ PQsetvalue(PGresult *res, int tup_num, int field_num, char *value, int len)
if (tup_num < 0 || tup_num > res->ntups)
return FALSE;
/* need to grow the tuple table? */
if (res->ntups >= res->tupArrSize)
{
int n = res->tupArrSize ? res->tupArrSize * 2 : 128;
PGresAttValue **tups;
if (res->tuples)
tups = (PGresAttValue **) realloc(res->tuples, n * sizeof(PGresAttValue *));
else
tups = (PGresAttValue **) malloc(n * sizeof(PGresAttValue *));
if (!tups)
return FALSE;
memset(tups + res->tupArrSize, 0,
(n - res->tupArrSize) * sizeof(PGresAttValue *));
res->tuples = tups;
res->tupArrSize = n;
}
/* need to allocate a new tuple? */
if (tup_num == res->ntups && !res->tuples[tup_num])
if (tup_num == res->ntups)
{
PGresAttValue *tup;
int i;
@ -464,8 +444,9 @@ PQsetvalue(PGresult *res, int tup_num, int field_num, char *value, int len)
tup[i].value = res->null_field;
}
res->tuples[tup_num] = tup;
res->ntups++;
/* add it to the array */
if (!pqAddTuple(res, tup))
return FALSE;
}
attval = &res->tuples[tup_num][field_num];