| From: | Ranier Vilela <ranier(dot)vf(at)gmail(dot)com> |
|---|---|
| To: | Pg Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Avoid possible overflow (src/port/bsearch_arg.c) |
| Date: | 2024-10-08 19:09:00 |
| Message-ID: | CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Hi.
The port function *bsearch_arg* mimics the C function
*bsearch*.
The API signature is:
void *
bsearch_arg(const void *key, const void *base0,
size_t nmemb, size_t size,
int (*compar) (const void *, const void *, void *),
void *arg)
So, the parameter *nmemb* is size_t.
Therefore, a call with nmemb greater than INT_MAX is possible.
Internally the code uses the *int* type to iterate through the number of
members, which makes overflow possible.
Trivial fix attached.
best regards,
Ranier Vilela
| Attachment | Content-Type | Size |
|---|---|---|
| avoid-possible-overflow-bsearch_arg.patch | application/octet-stream | 393 bytes |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2024-10-08 20:17:58 | Re: Better error reporting from extension scripts (Was: Extend ALTER OPERATOR) |
| Previous Message | Nathan Bossart | 2024-10-08 18:50:52 | Re: Large expressions in indexes can't be stored (non-TOASTable) |