summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTom Lane2014-12-16 20:35:33 +0000
committerTom Lane2014-12-16 20:35:33 +0000
commit66709133c7e5506be19bf56a82f45dd150f74732 (patch)
tree2291598f4d82a369a445483606c7fa75b46ee605
parentde8e46f5f5785f4016aabf2aa231faa89a0746fb (diff)
Fix off-by-one loop count in MapArrayTypeName, and get rid of static array.
MapArrayTypeName would copy up to NAMEDATALEN-1 bytes of the base type name, which of course is wrong: after prepending '_' there is only room for NAMEDATALEN-2 bytes. Aside from being the wrong result, this case would lead to overrunning the statically allocated work buffer. This would be a security bug if the function were ever used outside bootstrap mode, but it isn't, at least not in any currently supported branches. Aside from fixing the off-by-one loop logic, this patch gets rid of the static work buffer by having MapArrayTypeName pstrdup its result; the sole caller was already doing that, so this just requires moving the pstrdup call. This saves a few bytes but mainly it makes the API a lot cleaner. Back-patch on the off chance that there is some third-party code using MapArrayTypeName with less-secure input. Pushing pstrdup into the function should not cause any serious problems for such hypothetical code; at worst there might be a short term memory leak. Per Coverity scanning.
-rw-r--r--src/backend/bootstrap/bootscanner.l2
-rw-r--r--src/backend/bootstrap/bootstrap.c31
-rw-r--r--src/include/bootstrap/bootstrap.h2
3 files changed, 15 insertions, 20 deletions
diff --git a/src/backend/bootstrap/bootscanner.l b/src/backend/bootstrap/bootscanner.l
index f0316b8360..6ad8b32d99 100644
--- a/src/backend/bootstrap/bootscanner.l
+++ b/src/backend/bootstrap/bootscanner.l
@@ -111,7 +111,7 @@ insert { return(INSERT_TUPLE); }
"toast" { return(XTOAST); }
{arrayid} {
- yylval.str = pstrdup(MapArrayTypeName(yytext));
+ yylval.str = MapArrayTypeName(yytext);
return(ID);
}
{id} {
diff --git a/src/backend/bootstrap/bootstrap.c b/src/backend/bootstrap/bootstrap.c
index 4a542e65ca..ed2b05a905 100644
--- a/src/backend/bootstrap/bootstrap.c
+++ b/src/backend/bootstrap/bootstrap.c
@@ -1032,38 +1032,33 @@ AllocateAttribute(void)
return attribute;
}
-/* ----------------
+/*
* MapArrayTypeName
- * XXX arrays of "basetype" are always "_basetype".
- * this is an evil hack inherited from rel. 3.1.
- * XXX array dimension is thrown away because we
- * don't support fixed-dimension arrays. again,
- * sickness from 3.1.
*
- * the string passed in must have a '[' character in it
+ * Given a type name, produce the corresponding array type name by prepending
+ * '_' and truncating as needed to fit in NAMEDATALEN-1 bytes. This is only
+ * used in bootstrap mode, so we can get away with assuming that the input is
+ * ASCII and we don't need multibyte-aware truncation.
*
- * the string returned is a pointer to static storage and should NOT
- * be freed by the CALLER.
- * ----------------
+ * The given string normally ends with '[]' or '[digits]'; we discard that.
+ *
+ * The result is a palloc'd string.
*/
char *
-MapArrayTypeName(char *s)
+MapArrayTypeName(const char *s)
{
int i,
j;
- static char newStr[NAMEDATALEN]; /* array type names < NAMEDATALEN long */
+ char newStr[NAMEDATALEN];
- if (s == NULL || s[0] == '\0')
- return s;
-
- j = 1;
newStr[0] = '_';
- for (i = 0; i < NAMEDATALEN - 1 && s[i] != '['; i++, j++)
+ j = 1;
+ for (i = 0; i < NAMEDATALEN - 2 && s[i] != '['; i++, j++)
newStr[j] = s[i];
newStr[j] = '\0';
- return newStr;
+ return pstrdup(newStr);
}
diff --git a/src/include/bootstrap/bootstrap.h b/src/include/bootstrap/bootstrap.h
index 4d954eb28e..25a527ba82 100644
--- a/src/include/bootstrap/bootstrap.h
+++ b/src/include/bootstrap/bootstrap.h
@@ -40,7 +40,7 @@ extern void InsertOneTuple(Oid objectid);
extern void InsertOneValue(char *value, int i);
extern void InsertOneNull(int i);
-extern char *MapArrayTypeName(char *s);
+extern char *MapArrayTypeName(const char *s);
extern void index_register(Oid heap, Oid ind, IndexInfo *indexInfo);
extern void build_indices(void);