Commit 4053189d authored by Peter Eisentraut's avatar Peter Eisentraut

Avoid potential buffer overflow crash

A pointer to a C string was treated as a pointer to a "name" datum and
passed to SPI_execute_plan().  This pointer would then end up being
passed through datumCopy(), which would try to copy the entire 64 bytes
of name data, thus running past the end of the C string.  Fix by
converting the string to a proper name structure.

Found by LLVM AddressSanitizer.
parent f19e92ed
...@@ -632,7 +632,7 @@ pg_get_viewdef_worker(Oid viewoid, int prettyFlags, int wrapColumn) ...@@ -632,7 +632,7 @@ pg_get_viewdef_worker(Oid viewoid, int prettyFlags, int wrapColumn)
* Get the pg_rewrite tuple for the view's SELECT rule * Get the pg_rewrite tuple for the view's SELECT rule
*/ */
args[0] = ObjectIdGetDatum(viewoid); args[0] = ObjectIdGetDatum(viewoid);
args[1] = PointerGetDatum(ViewSelectRuleName); args[1] = DirectFunctionCall1(namein, CStringGetDatum(ViewSelectRuleName));
nulls[0] = ' '; nulls[0] = ' ';
nulls[1] = ' '; nulls[1] = ' ';
spirc = SPI_execute_plan(plan_getviewrule, args, nulls, true, 2); spirc = SPI_execute_plan(plan_getviewrule, args, nulls, true, 2);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment