numeric access out of bounds
От | Andrew Gierth |
---|---|
Тема | numeric access out of bounds |
Дата | |
Msg-id | 8761bwiehf.fsf@news-spur.riddles.org.uk обсуждение исходный текст |
Ответы |
Re: numeric access out of bounds
|
Список | pgsql-hackers |
Happened to notice this: postgres=# select numeric_send('NaN'); numeric_send --------------------\x00007f7ec0000000 (1 row) 7f7e obviously screams "accessing memory beyond the end of data", and indeed this is so: init_var_from_num, when passed a NaN, accesses two bytes after the input. This probably goes unnoticed because a NaN is 6 bytes including varlena header, so the next two bytes wouldn't cause a segfault (and clients shouldn't care about the value since the NaN flag is set), but it's still clearly wrong. I can see two possible fixes: one to correct the assumptions in the macros, the other to check for NaN before calling init_var_from_num in numeric_send (all the other functions seem to do this check explicitly). Which would be preferable? -- Andrew (irc:RhodiumToad)
В списке pgsql-hackers по дате отправления: