database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-02 09:02:37 +03:00
Code Activity

Fix bogus calculation of potential output string length in translate().

Browse Source
This commit is contained in:
Tom Lane
2007-09-22 05:36:14 +00:00
parent 0a3b51efa0
commit a51302deb3
1 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/backend/utils/adt/oracle_compat.c
View File

@ -9,7 +9,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/utils/adt/oracle_compat.c,v 1.48 2003/08/08 21:42:06 momjian Exp $ * $Header: /cvsroot/pgsql/src/backend/utils/adt/oracle_compat.c,v 1.48.4.1 2007/09/22 05:36:14 tgl Exp $
* *
*------------------------------------------------------------------------- *-------------------------------------------------------------------------
*/ */
@ -750,27 +750,34 @@ translate(PG_FUNCTION_ARGS)
tolen, tolen,
retlen, retlen,
i; i;
int worst_len;
int str_len;
int estimate_len;
int len; int len;
int source_len; int source_len;
int from_index; int from_index;
if ((m = VARSIZE(string) - VARHDRSZ) <= 0) m = VARSIZE(string) - VARHDRSZ;
if (m <= 0)
PG_RETURN_TEXT_P(string); PG_RETURN_TEXT_P(string);
source = VARDATA(string);
fromlen = VARSIZE(from) - VARHDRSZ; fromlen = VARSIZE(from) - VARHDRSZ;
from_ptr = VARDATA(from); from_ptr = VARDATA(from);
tolen = VARSIZE(to) - VARHDRSZ; tolen = VARSIZE(to) - VARHDRSZ;
to_ptr = VARDATA(to); to_ptr = VARDATA(to);
str_len = VARSIZE(string); /*
estimate_len = (tolen * 1.0 / fromlen + 0.5) * str_len; * The worst-case expansion is to substitute a max-length character for
estimate_len = estimate_len > str_len ? estimate_len : str_len; * a single-byte character at each position of the string.
result = (text *) palloc(estimate_len); */
worst_len = pg_database_encoding_max_length() * m;
source = VARDATA(string); /* check for integer overflow */
if (worst_len / pg_database_encoding_max_length() != m)
ereport(ERROR,
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
errmsg("requested length too large")));
result = (text *) palloc(worst_len + VARHDRSZ);
target = VARDATA(result); target = VARDATA(result);
retlen = 0; retlen = 0;