diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2013-11-23 07:25:37 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2013-11-23 07:31:32 -0500 |
| commit | 44032290dd23ccc0c227ee2af4f9e8c0e58077e8 (patch) | |
| tree | 5de4c4aab0f88c12b8cfbb1f973cad47ce165fa7 /src/backend/rewrite/rewriteSupport.c | |
| parent | 612f953c7c3e8f5eed50607b56d461c88196c3a7 (diff) | |
Avoid potential buffer overflow crash
A pointer to a C string was treated as a pointer to a "name" datum and
passed to SPI_execute_plan(). This pointer would then end up being
passed through datumCopy(), which would try to copy the entire 64 bytes
of name data, thus running past the end of the C string. Fix by
converting the string to a proper name structure.
Found by LLVM AddressSanitizer.
Diffstat (limited to 'src/backend/rewrite/rewriteSupport.c')
0 files changed, 0 insertions, 0 deletions