Commit c5e073ca authored by Peter Eisentraut's avatar Peter Eisentraut

ecpg: Fix off-by-one error in memory copying

In a rare case, one byte past the end of memory belonging to the
sqlca_t structure would be written to.

found by Coverity
parent 8dd4d10d
......@@ -525,7 +525,7 @@ ECPGset_var(int number, void *pointer, int lineno)
struct sqlca_t *sqlca = ECPGget_sqlca();
sqlca->sqlcode = ECPG_OUT_OF_MEMORY;
strncpy(sqlca->sqlstate, "YE001", sizeof("YE001"));
strncpy(sqlca->sqlstate, "YE001", sizeof(sqlca->sqlstate));
snprintf(sqlca->sqlerrm.sqlerrmc, sizeof(sqlca->sqlerrm.sqlerrmc), "out of memory on line %d", lineno);
sqlca->sqlerrm.sqlerrml = strlen(sqlca->sqlerrm.sqlerrmc);
/* free all memory we have allocated for the user */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment