mirrors/postgres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix xslt_process() to ensure that it inserts a NULL terminator after the

Browse Source 
last pair of parameter name/value strings, even when there are MAXPARAMS
of them.  Aboriginal bug in contrib/xml2, noted while studying bug #4912
(though I'm not sure whether there's something else involved in that
report).

This might be thought a security issue, since it's a potential backend
crash; but considering that untrustworthy users shouldn't be allowed
to get their hands on xslt_process() anyway, it's probably not worth
getting excited about.
This commit is contained in:
Tom Lane 2009-07-10 00:32:06 +00:00
parent 4f6bcc8314
commit c75b054b0d
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
contrib/xml2/xslt_proc.c
View File

@ -1,5 +1,5 @@
/* /*
* $PostgreSQL: pgsql/contrib/xml2/xslt_proc.c,v 1.15 2009/06/11 14:48:53 momjian Exp $ * $PostgreSQL: pgsql/contrib/xml2/xslt_proc.c,v 1.15.2.1 2009/07/10 00:32:06 tgl Exp $
* *
* XSLT processing functions (requiring libxslt) * XSLT processing functions (requiring libxslt)
* *
@ -38,7 +38,8 @@ static void parse_params(const char **params, text *paramstr);
Datum xslt_process(PG_FUNCTION_ARGS); Datum xslt_process(PG_FUNCTION_ARGS);
#define MAXPARAMS 20 #define MAXPARAMS 20 /* must be even, see parse_params() */
PG_FUNCTION_INFO_V1(xslt_process); PG_FUNCTION_INFO_V1(xslt_process);
@ -129,12 +130,11 @@ xslt_process(PG_FUNCTION_ARGS)
} }
void static void
parse_params(const char **params, text *paramstr) parse_params(const char **params, text *paramstr)
{ {
char *pos; char *pos;
char *pstr; char *pstr;
int i; int i;
char *nvsep = "="; char *nvsep = "=";
char *itsep = ","; char *itsep = ",";
@ -154,11 +154,13 @@ parse_params(const char **params, text *paramstr)
} }
else else
{ {
params[i] = NULL; /* No equal sign, so ignore this "parameter" */
/* We'll reset params[i] to NULL below the loop */
break; break;
} }
/* Value */ /* Value */
i++; i++;
/* since MAXPARAMS is even, we still have i < MAXPARAMS */
params[i] = pos; params[i] = pos;
pos = strstr(pos, itsep); pos = strstr(pos, itsep);
if (pos != NULL) if (pos != NULL)
@ -167,9 +169,11 @@ parse_params(const char **params, text *paramstr)
pos++; pos++;
} }
else else
{
i++;
break; break;
}
} }
if (i < MAXPARAMS)
params[i + 1] = NULL; params[i] = NULL;
} }