Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible by

8, bitncmp() may dereference a pointer one byte out of bounds.

Chris Mikkelson (bug #5101)

diff --git a/src/backend/utils/adt/network.c b/src/backend/utils/adt/network.c
index 3b526d0655bc5984a5f69b136dec9e96371bfe3f..342838f63f39419334abe7c59e5b6e11197b04e3 100644 (file)
--- a/src/backend/utils/adt/network.c
+++ b/src/backend/utils/adt/network.c
@@ -1,7 +1,7 @@
 /*
  *     PostgreSQL type definitions for the INET and CIDR types.
  *
- *     $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.56 2005/10/17 16:24:19 tgl Exp $
+ *     $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.56.2.1 2009/10/08 04:46:52 heikki Exp $
  *
  *     Jon Postel RIP 16 Oct 1998
  */
@@ -897,7 +897,7 @@ bitncmp(void *l, void *r, int n)
 
        b = n / 8;
        x = memcmp(l, r, b);
-       if (x)
+       if (x || (n % 8) == 0)
                return (x);
 
        lb = ((const u_char *) l)[b];