From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date: Thu, 8 Oct 2009 04:46:44 +0000 (+0000)
Subject: Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible by
X-Git-Tag: REL8_2_15~19
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b357128a96ecd056381d1e0a54df2f9de5f8253b;p=thirdparty%2Fpostgresql.git

Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible by
8, bitncmp() may dereference a pointer one byte out of bounds.

Chris Mikkelson (bug #5101)
---

diff --git a/src/backend/utils/adt/network.c b/src/backend/utils/adt/network.c
index bb9210e16d2..0580c474096 100644
--- a/src/backend/utils/adt/network.c
+++ b/src/backend/utils/adt/network.c
@@ -1,7 +1,7 @@
 /*
  *	PostgreSQL type definitions for the INET and CIDR types.
  *
- *	$PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.66.2.1 2007/05/17 23:31:59 tgl Exp $
+ *	$PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.66.2.2 2009/10/08 04:46:44 heikki Exp $
  *
  *	Jon Postel RIP 16 Oct 1998
  */
@@ -1015,7 +1015,7 @@ bitncmp(void *l, void *r, int n)
 
 	b = n / 8;
 	x = memcmp(l, r, b);
-	if (x)
+	if (x || (n % 8) == 0)
 		return x;
 
 	lb = ((const u_char *) l)[b];