diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2013-11-23 07:25:37 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2013-11-23 07:30:45 -0500 |
| commit | 654e006bbaa00610055273e1e08723b1f63ea6ce (patch) | |
| tree | d7ca0df87873a4624c4ec8076b91483420710d5a /src/backend/utils/adt/ruleutils.c | |
| parent | c0aa210f6ebab06ca3933c735c7c6d2b8bdd024e (diff) | |
Avoid potential buffer overflow crash
A pointer to a C string was treated as a pointer to a "name" datum and
passed to SPI_execute_plan(). This pointer would then end up being
passed through datumCopy(), which would try to copy the entire 64 bytes
of name data, thus running past the end of the C string. Fix by
converting the string to a proper name structure.
Found by LLVM AddressSanitizer.
Diffstat (limited to 'src/backend/utils/adt/ruleutils.c')
| -rw-r--r-- | src/backend/utils/adt/ruleutils.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c index afab3811253..d4b2b8bc190 100644 --- a/src/backend/utils/adt/ruleutils.c +++ b/src/backend/utils/adt/ruleutils.c @@ -483,7 +483,7 @@ pg_get_viewdef_worker(Oid viewoid, int prettyFlags, int wrapColumn) * Get the pg_rewrite tuple for the view's SELECT rule */ args[0] = ObjectIdGetDatum(viewoid); - args[1] = PointerGetDatum(ViewSelectRuleName); + args[1] = DirectFunctionCall1(namein, CStringGetDatum(ViewSelectRuleName)); nulls[0] = ' '; nulls[1] = ' '; spirc = SPI_execute_plan(plan_getviewrule, args, nulls, true, 2); |