]> git.ipfire.org Git - thirdparty/postgresql.git/commit
Ensure maxlen is at leat 1 in dict_int
authorTomas Vondra <tomas.vondra@postgresql.org>
Tue, 3 Dec 2019 15:55:51 +0000 (16:55 +0100)
committerTomas Vondra <tomas.vondra@postgresql.org>
Tue, 3 Dec 2019 17:43:15 +0000 (18:43 +0100)
commit44381b1aff0e92acc91381c40f1b07514e93a18b
tree9bb08aedd4a3f912dabaae6cde4143116b185a9b
parent0c84e992c3309e1a0a80ebf3af9ebead9e23d58f
Ensure maxlen is at leat 1 in dict_int

The dict_int text search dictionary template accepts maxlen parameter,
which is then used to cap the length of input strings. The value was
not properly checked, and the code simply does

    txt[d->maxlen] = '\0';

to insert a terminator, leading to segfaults with negative values.

This commit simply rejects values less than 1. The issue was there since
dct_int was introduced in 9.3, so backpatch all the way back to 9.4
which is the oldest supported version.

Reported-by: cili
Discussion: https://postgr.es/m/16144-a36a5bef7657047d@postgresql.org
Backpatch-through: 9.4
contrib/dict_int/dict_int.c
contrib/dict_int/expected/dict_int.out
contrib/dict_int/sql/dict_int.sql