git.postgresql.org Git - postgresql.git/commitdiff

git projects / postgresql.git / commitdiff

Fix write-past-buffer-end in ldapServiceLookup().

2011年5月12日 15:56:38 +0000 (11:56 -0400)

2011年5月12日 15:57:05 +0000 (11:57 -0400)

The code to assemble ldap_get_values_len's output into a single string
wrote the terminating null one byte past where it should. Fix that,
and make some other cosmetic adjustments to make the code a trifle more
readable and more in line with usual Postgres coding style.

Also, free the "result" string when done with it, to avoid a permanent
memory leak.

Bug report and patch by Albe Laurenz, cosmetic adjustments by me.

src/interfaces/libpq/fe-connect.c patch | blob | blame | history

diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c

index cc76150cb3cc76864ddc1a542e4243d86fddec38..0efc1700c9313445480a54896a7c84a04524cee0 100644 (file)

--- a/src/interfaces/libpq/fe-connect.c

+++ b/src/interfaces/libpq/fe-connect.c

@@ -3339,10 +3339,11 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

return 1;

}

- /* concatenate values to a single string */

- for (size = 0, i = 0; values[i] != NULL; ++i)

+ /* concatenate values into a single string with newline terminators */

+ size = 1; /* for the trailing null */

+ for (i = 0; values[i] != NULL; i++)

size += values[i]->bv_len + 1;

- if ((result = malloc(size + 1)) == NULL)

+ if ((result = malloc(size)) == NULL)

{

printfPQExpBuffer(errorMessage,

libpq_gettext("out of memory\n"));

@@ -3350,14 +3351,14 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

ldap_unbind(ld);

return 3;

}

- for (p = result, i = 0; values[i] != NULL; ++i)

+ p = result;

+ for (i = 0; values[i] != NULL; i++)

{

- strncpy(p, values[i]->bv_val, values[i]->bv_len);

+ memcpy(p, values[i]->bv_val, values[i]->bv_len);

p += values[i]->bv_len;

*(p++) = '\n';

- if (values[i + 1] == NULL)

- *(p + 1) = '0円';

}

+ *p = '0円';

ldap_value_free_len(values);

ldap_unbind(ld);

@@ -3386,6 +3387,7 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

printfPQExpBuffer(errorMessage, libpq_gettext(

"missing \"=\" after \"%s\" in connection info string\n"),

optname);

+ free(result);

return 3;

}

else if (*p == '=')

@@ -3404,6 +3406,7 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

printfPQExpBuffer(errorMessage, libpq_gettext(

"missing \"=\" after \"%s\" in connection info string\n"),

optname);

+ free(result);

return 3;

}

break;

@@ -3467,6 +3470,7 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

printfPQExpBuffer(errorMessage,

libpq_gettext("invalid connection option \"%s\"\n"),

optname);

+ free(result);

return 1;

}

optname = NULL;

@@ -3475,6 +3479,8 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,

oldstate = state;

}

+ free(result);

if (state == 5 || state == 6)

{

printfPQExpBuffer(errorMessage, libpq_gettext(

This is the main PostgreSQL git repository.

RSS Atom