mirror of
https://github.com/postgres/postgres.git
synced 2025-06-27 23:21:58 +03:00
Tweak libpq to avoid crashing due to incorrect buffer size calculation when
we are on a 64-bit machine (ie, size_t is wider than int) and someone passes in a query string that approaches or exceeds INT_MAX bytes. Also, just for paranoia's sake, guard against similar overflows in sizing the input buffer. The backend will not in the foreseeable future be prepared to send or receive strings exceeding 1GB, so I didn't take the more invasive step of switching all the buffer index variables from int to size_t; though someday we might want to do that. I have a suspicion that this is not the only such bug in libpq, but this fix is enough to take care of the crash reported by Francisco Reyes.
This commit is contained in:
@ -8,7 +8,7 @@
|
||||
*
|
||||
*
|
||||
* IDENTIFICATION
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.358 2008/05/16 18:30:53 mha Exp $
|
||||
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.359 2008/05/29 22:02:44 tgl Exp $
|
||||
*
|
||||
*-------------------------------------------------------------------------
|
||||
*/
|
||||
@ -1581,7 +1581,8 @@ keep_going: /* We will come back to here until there is
|
||||
* needed to hold the whole message; see notes in
|
||||
* pqParseInput3.
|
||||
*/
|
||||
if (pqCheckInBufferSpace(conn->inCursor + msgLength, conn))
|
||||
if (pqCheckInBufferSpace(conn->inCursor + (size_t) msgLength,
|
||||
conn))
|
||||
goto error_return;
|
||||
/* We'll come back when there is more data */
|
||||
return PGRES_POLLING_READING;
|
||||
|
Reference in New Issue
Block a user