From: | Ranier Vilela <ranier(dot)vf(at)gmail(dot)com> |
---|---|
To: | Pg Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Avoid possible overflow (src/port/bsearch_arg.c) |
Date: | 2024-10-08 19:09:00 |
Message-ID: | CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Hi.
The port function *bsearch_arg* mimics the C function
*bsearch*.
The API signature is:
void *
bsearch_arg(const void *key, const void *base0,
size_t nmemb, size_t size,
int (*compar) (const void *, const void *, void *),
void *arg)
So, the parameter *nmemb* is size_t.
Therefore, a call with nmemb greater than INT_MAX is possible.
Internally the code uses the *int* type to iterate through the number of
members, which makes overflow possible.
Trivial fix attached.
best regards,
Ranier Vilela
Attachment | Content-Type | Size |
---|---|---|
avoid-possible-overflow-bsearch_arg.patch | application/octet-stream | 393 bytes |
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2024-10-08 20:17:58 | Re: Better error reporting from extension scripts (Was: Extend ALTER OPERATOR) |
Previous Message | Nathan Bossart | 2024-10-08 18:50:52 | Re: Large expressions in indexes can't be stored (non-TOASTable) |