numeric access out of bounds
| От | Andrew Gierth |
|---|---|
| Тема | numeric access out of bounds |
| Дата | |
| Msg-id | 8761bwiehf.fsf@news-spur.riddles.org.uk обсуждение исходный текст |
| Ответы |
Re: numeric access out of bounds
|
| Список | pgsql-hackers |
Happened to notice this:
postgres=# select numeric_send('NaN'); numeric_send
--------------------\x00007f7ec0000000
(1 row)
7f7e obviously screams "accessing memory beyond the end of data", and
indeed this is so: init_var_from_num, when passed a NaN, accesses two
bytes after the input. This probably goes unnoticed because a NaN is 6
bytes including varlena header, so the next two bytes wouldn't cause a
segfault (and clients shouldn't care about the value since the NaN flag
is set), but it's still clearly wrong.
I can see two possible fixes: one to correct the assumptions in the
macros, the other to check for NaN before calling init_var_from_num in
numeric_send (all the other functions seem to do this check explicitly).
Which would be preferable?
--
Andrew (irc:RhodiumToad)
В списке pgsql-hackers по дате отправления: