database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-03 22:24:49 +03:00
Code

Fix some possible low-memory failures in regexp compilation.

Browse Source 
newnfa() failed to set the regex error state when malloc() fails.
Several places in regcomp.c failed to check for an error after calling
subre().  Each of these mistakes could lead to null-pointer-dereference
crashes in memory-starved backends.

Report and patch by Andreas Seltenreich.  Back-patch to all branches.
This commit is contained in:
Tom Lane 2015-08-12 00:48:11 -04:00
parent 58d2e7fb70
commit c5bfcc18a0
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/backend/regex/regc_nfa.c
View File

@ -52,7 +52,10 @@ newnfa(struct vars * v,
nfa = (struct nfa *) MALLOC(sizeof(struct nfa)); nfa = (struct nfa *) MALLOC(sizeof(struct nfa));
if (nfa == NULL) if (nfa == NULL)
{
ERR(REG_ESPACE);
return NULL; return NULL;
}
nfa->states = NULL; nfa->states = NULL;
nfa->slast = NULL; nfa->slast = NULL;

3
src/backend/regex/regcomp.c
View File

@ -942,6 +942,7 @@ parseqatom(struct vars * v,
NOERR(); NOERR();
assert(v->nextvalue > 0); assert(v->nextvalue > 0);
atom = subre(v, 'b', BACKR, lp, rp); atom = subre(v, 'b', BACKR, lp, rp);
NOERR();
subno = v->nextvalue; subno = v->nextvalue;
atom->subno = subno; atom->subno = subno;
EMPTYARC(lp, rp); /* temporarily, so there's something */ EMPTYARC(lp, rp); /* temporarily, so there's something */
@ -1076,6 +1077,7 @@ parseqatom(struct vars * v,
/* break remaining subRE into x{...} and what follows */ /* break remaining subRE into x{...} and what follows */
t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp); t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp);
NOERR();
t->left = atom; t->left = atom;
atomp = &t->left; atomp = &t->left;
@ -1084,6 +1086,7 @@ parseqatom(struct vars * v,
/* split top into prefix and remaining */ /* split top into prefix and remaining */
assert(top->op == '=' && top->left == NULL && top->right == NULL); assert(top->op == '=' && top->left == NULL && top->right == NULL);
top->left = subre(v, '=', top->flags, top->begin, lp); top->left = subre(v, '=', top->flags, top->begin, lp);
NOERR();
top->op = '.'; top->op = '.';
top->right = t; top->right = t;