| From: | Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> |
|---|---|
| To: | Neil Conway <neilc(at)samurai(dot)com> |
| Cc: | Jukka Holappa <jukkaho(at)mail(dot)student(dot)oulu(dot)fi>, pgsql-hackers(at)postgresql(dot)org |
| Subject: | Re: [Resend] Sprintf() auditing and a patch |
| Date: | 2002-08-29 18:43:28 |
| Message-ID: | 200208291843.g7TIhSs14454@candle.pha.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Neil Conway wrote:
> If you're interested, another common source of problems is integer
> overflow when dealing with numeric input from the user. In fact, far
> more security problems have been caused by insufficient integer
> overflow checking than by string handling bugs.
One other things that bothers me are cases where we allocate memory to
hold the ASCII representation of an integer, but instead of using a
macro that documents this fact, we use a constant, and different
constants in different places. That should be cleaned up.
--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
| From | Date | Subject | |
|---|---|---|---|
| Next Message | D'Arcy J.M. Cain | 2002-08-29 19:18:11 | Re: Type definition process (was Re: MemoryContextAlloc: invalid request size 1934906735) |
| Previous Message | Bruce Momjian | 2002-08-29 18:32:31 | Re: C vs. C++ contributions |