Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible by

8, bitncmp() may dereference a pointer one byte out of bounds.

Chris Mikkelson (bug #5101)

diff --git a/src/backend/utils/adt/network.c b/src/backend/utils/adt/network.c
index dc83d7028c5e0367b36902f3ec2bf8bf785f1ee7..b13d3d16e16742f4c8214a3092373114f03bbd0e 100644 (file)
--- a/src/backend/utils/adt/network.c
+++ b/src/backend/utils/adt/network.c
@@ -1,7 +1,7 @@
 /*
  *     PostgreSQL type definitions for the INET and CIDR types.
  *
- *     $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.54 2004/10/08 01:10:31 momjian Exp $
+ *     $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.54.4.1 2009/10/08 04:46:59 heikki Exp $
  *
  *     Jon Postel RIP 16 Oct 1998
  */
@@ -899,7 +899,7 @@ bitncmp(void *l, void *r, int n)
 
        b = n / 8;
        x = memcmp(l, r, b);
-       if (x)
+       if (x || (n % 8) == 0)
                return (x);
 
        lb = ((const u_char *) l)[b];