Re: [Resend] Sprintf() auditing and a patch

Поиск
Список
Период
Сортировка
От Bruce Momjian
Тема Re: [Resend] Sprintf() auditing and a patch
Дата
Msg-id 200208291843.g7TIhSs14454@candle.pha.pa.us
обсуждение исходный текст
Ответ на Re: [Resend] Sprintf() auditing and a patch  (Neil Conway <neilc@samurai.com>)
Список pgsql-hackers
Neil Conway wrote:
> If you're interested, another common source of problems is integer
> overflow when dealing with numeric input from the user. In fact, far
> more security problems have been caused by insufficient integer
> overflow checking than by string handling bugs.

One other things that bothers me are cases where we allocate memory to
hold the ASCII representation of an integer, but instead of using a
macro that documents this fact, we use a constant, and different
constants in different places.  That should be cleaned up.

--  Bruce Momjian                        |  http://candle.pha.pa.us pgman@candle.pha.pa.us               |  (610)
359-1001+  If your life is a hard drive,     |  13 Roberts Road +  Christ can be your backup.        |  Newtown Square,
Pennsylvania19073
 


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Bruce Momjian
Дата:
Сообщение: Re: C vs. C++ contributions
Следующее
От: "D'Arcy J.M. Cain"
Дата:
Сообщение: Re: Type definition process (was Re: MemoryContextAlloc: invalid request size 1934906735)