pq_getstr didn't handle buffer overrun correctly; it would

fail to consume the rest of the input string, and worse it would write
one more byte than it should into the buffer, probably resulting in coredump.
Fortunately there's a correct implementation next door in pqcomprim.c.

diff --git a/src/backend/libpq/pqcomm.c b/src/backend/libpq/pqcomm.c
index 04ebddb5e69250ca419df6879bc57ee063b07d45..623e8a1d10cedafb56ecd0358fcda274d3f6c221 100644 (file)
--- a/src/backend/libpq/pqcomm.c
+++ b/src/backend/libpq/pqcomm.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/backend/libpq/pqcomm.c,v 1.57 1998/10/13 20:44:40 scrappy Exp $
+ *       $Header: /cvsroot/pgsql/src/backend/libpq/pqcomm.c,v 1.58 1998/11/29 01:47:42 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -108,6 +108,9 @@ pq_init(int fd)
  *
  *      used for debugging libpq
  */
+
+#if 0                                                  /* not used anymore */
+
 static int
 pq_getc(FILE *fin)
 {
@@ -119,6 +122,8 @@ pq_getc(FILE *fin)
        return c;
 }
 
+#endif
+
 /* --------------------------------
  *             pq_gettty - return the name of the tty in the given buffer
  * --------------------------------
@@ -181,15 +186,9 @@ pq_flush()
 int
 pq_getstr(char *s, int maxlen)
 {
-       int                     c = '\0';
-
+       int                     c;
 #ifdef MULTIBYTE
-       unsigned char *p,
-                          *ps;
-       int                     len;
-
-       ps = s;
-       len = maxlen;
+       char       *p;
 #endif
 
        if (Pfin == (FILE *) NULL)
@@ -198,27 +197,15 @@ pq_getstr(char *s, int maxlen)
                return EOF;
        }
 
-       while (maxlen-- && (c = pq_getc(Pfin)) != EOF && c)
-               *s++ = c;
-       *s = '\0';
+       c = pqGetString(s, maxlen, Pfin);
 
 #ifdef MULTIBYTE
-       p = pg_client_to_server(ps, len);
-       if (ps != p)
-       {                                                       /* actual conversion has been done? */
-               strcpy(ps, p);
-       }
+       p = (char*) pg_client_to_server((unsigned char *) s, maxlen);
+       if (s != p)                                     /* actual conversion has been done? */
+               strcpy(s, p);
 #endif
 
-       /* -----------------
-        *         If EOF reached let caller know.
-        *         (This will only happen if we hit EOF before the string
-        *         delimiter is reached.)
-        * -----------------
-        */
-       if (c == EOF)
-               return EOF;
-       return !EOF;
+       return c;
 }
 
 /*