Re: Returning non-terminated string in ECPG Informix-compatible function
Oleg Tselebrovskiy <o.tselebrovskiy@postgrespro.ru>
From: Oleg Tselebrovskiy <o.tselebrovskiy@postgrespro.ru>
To: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Cc: pgsql-hackers@postgresql.org
Date: 2024-01-30T10:56:22Z
Lists: pgsql-hackers
Here's the code for bug reproduction:
#include <stdio.h>
#include <stdlib.h>
EXEC SQL INCLUDE pgtypes_interval.h;
EXEC SQL INCLUDE ecpg_informix.h;
EXEC SQL BEGIN DECLARE SECTION;
char dirty_str[100] = "aaaaaaaaa_bbbbbbbb_ccccccccc_ddddddddd_";
interval *interval_ptr;
EXEC SQL END DECLARE SECTION;
int main()
{
interval_ptr = (interval *) malloc(sizeof(interval));
interval_ptr->time = 100000000;
interval_ptr->month = 240;
printf("dirty_str contents before intoasc: %s\n", dirty_str);
intoasc(interval_ptr, dirty_str);
printf("dirty_str contents after intoasc: %s\n", dirty_str);
return 0;
}
And here's the output:
dirty_str contents before intoasc:
aaaaaaaaa_bbbbbbbb_ccccccccc_ddddddddd_
dirty_str contents after intoasc: @ 20 years 1 min 40
secscccc_ddddddddd_
I compiled it with following commands (provided for quicker
reproduction):
/path/to/pgsql/bin/ecpg informix_bug_example.pgc
gcc -I/path/to/pgsql/include -c informix_bug_example.c
gcc -o informix_bug_example informix_bug_example.o -L/path/to/pgsql/lib
-lecpg -lecpg_compat
I've also found at least one project that uses intoasc() in it -
https://github.com/credativ/informix_fdw/
Oleg Tselebrovskiy, Postgres Pro
Commits
-
ecpg: Fix zero-termination of string generated by intoasc()
- 771240f972ee 12.19 landed
- c031ce97b561 13.15 landed
- a05bb9addb37 14.12 landed
- b5cb6022bbf0 15.7 landed
- 88e03d055d18 16.3 landed
- e77a1c58e338 17.0 landed
-
ecpg: Fix error handling on OOMs when parsing timestamps
- 0a9118ccc0eb 17.0 landed