1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the

Browse Source 
byte after the last full byte of the bit array, regardless of whether that
byte was part of the valid data or not.  Found by buildfarm testing.
Thanks to Stefan Kaltenbrunner for nailing down the cause.
This commit is contained in:
Tom Lane 2007-08-21 02:40:18 +00:00
parent d8cb5391c2
commit bbb7e05c32
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/backend/utils/adt/varbit.c
View File

@ -9,7 +9,7 @@
* Portions Copyright (c) 1994, Regents of the University of California
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/utils/adt/varbit.c,v 1.47 2005/10/15 02:49:30 momjian Exp $
* $PostgreSQL: pgsql/src/backend/utils/adt/varbit.c,v 1.47.2.1 2007/08/21 02:40:18 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@ -472,8 +472,9 @@ varbit_out(PG_FUNCTION_ARGS)
result = (char *) palloc(len + 1);
sp = VARBITS(s);
r = result;
for (i = 0; i < len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
for (i = 0; i <= len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
{
/* print full bytes */
x = *sp;
for (k = 0; k < BITS_PER_BYTE; k++)
{
@ -481,11 +482,15 @@ varbit_out(PG_FUNCTION_ARGS)
x <<= 1;
}
}
x = *sp;
for (k = i; k < len; k++)
if (i < len)
{
*r++ = (x & BITHIGH) ? '1' : '0';
x <<= 1;
/* print the last partial byte */
x = *sp;
for (k = i; k < len; k++)
{
*r++ = (x & BITHIGH) ? '1' : '0';
x <<= 1;
}
}
*r = '\0';