1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Prevent overrunning a heap-allocated buffer if more than 1024 parameters

Browse Source 
to a refcursor declaration are specified. This is a minimally-invasive fix
for the buffer overrun -- a more thorough cleanup will be checked into
HEAD.
This commit is contained in:
Neil Conway 2005-01-21 00:31:21 +00:00
parent ce69fa9768
commit 3b01217d7d
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/pl/plpgsql/src/gram.y
View File

@ -4,7 +4,7 @@
* procedural language * procedural language
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/pl/plpgsql/src/gram.y,v 1.48 2003/10/30 17:18:55 tgl Exp $ * $Header: /cvsroot/pgsql/src/pl/plpgsql/src/gram.y,v 1.48.2.1 2005/01/21 00:31:21 neilc Exp $
* *
* This software is copyrighted by Jan Wieck - Hamburg. * This software is copyrighted by Jan Wieck - Hamburg.
* *
@ -512,6 +512,10 @@ decl_cursor_arglist : decl_cursor_arg
{ {
int i = $1->nfields++; int i = $1->nfields++;
/* Guard against overflowing the array on malicious input */
if (i >= 1024)
yyerror("too many parameters specified for refcursor");
$1->fieldnames[i] = $3->refname; $1->fieldnames[i] = $3->refname;
$1->varnos[i] = $3->varno; $1->varnos[i] = $3->varno;