• Tom Lane's avatar
    Fix assorted integer-overflow hazards in varbit.c. · 32fdf42c
    Tom Lane authored
    bitshiftright() and bitshiftleft() would recursively call each other
    infinitely if the user passed INT_MIN for the shift amount, due to integer
    overflow in negating the shift amount.  To fix, clamp to -VARBITMAXLEN.
    That doesn't change the results since any shift distance larger than the
    input bit string's length produces an all-zeroes result.
    
    Also fix some places that seemed inadequately paranoid about input typmods
    exceeding VARBITMAXLEN.  While a typmod accepted by anybit_typmodin() will
    certainly be much less than that, at least some of these spots are
    reachable with user-chosen integer values.
    
    Andreas Seltenreich and Tom Lane
    
    Discussion: <87d1j2zqtz.fsf@credativ.de>
    32fdf42c
varbit.c 41.3 KB