From: | Michael Wood <esiotrot(at)gmail(dot)com> |
---|---|
To: | mladen(dot)gogala(at)vmsinfo(dot)com |
Cc: | Andrej <andrej(dot)groups(at)gmail(dot)com>, Amish <amish(dot)pandya(at)in(dot)com>, "pgsql-novice(at)postgresql(dot)org" <pgsql-novice(at)postgresql(dot)org> |
Subject: | Re: ERROR: invalid datatype 'FILE' |
Date: | 2011-02-02 14:08:13 |
Message-ID: | AANLkTikV0a=QUKSEwUYKYqxxgEWmko-B_y13sgz-5u79@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-novice |
On 2 February 2011 15:38, Mladen Gogala <mladen(dot)gogala(at)vmsinfo(dot)com> wrote:
> Michael Wood wrote:
>>
>> I'll have to object to the "bug free" comment :)
>>
>> You don't check if the fopen() call succeeded.
>>
>> Also, if this code is run as root (e.g. from a cron job) then a local
>> user could convince it to overwrite any arbitrary file just by
>> creating a symlink in /tmp pointing to the file to overwrite (assuming
>> /tmp/aaa doesn't exist before the malicious user creates the symlink,
>> of course.)
>
> You are correct, I admit my programming sins. With two bugs in two lines of
> code, I am as good as Microsoft or Oracle. I'll have to start making
> contributions to the Postgres community.
:)
I thought afterwards that perhaps you meant we got any included bugs for free.
--
Michael Wood <esiotrot(at)gmail(dot)com>
From | Date | Subject | |
---|---|---|---|
Next Message | Basil Bourque | 2011-02-02 22:09:18 | Make pgAdmin default "Not NULL" checkbox to ON |
Previous Message | Mladen Gogala | 2011-02-02 13:38:55 | Re: ERROR: invalid datatype 'FILE' |