Horton

Re: Returning non-terminated string in ECPG Informix-compatible function

Oleg Tselebrovskiy <o.tselebrovskiy@postgrespro.ru>

View thread View on postgr.es
From: Oleg Tselebrovskiy <o.tselebrovskiy@postgrespro.ru>
To: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Cc: pgsql-hackers@postgresql.org
Date: 2024-02-15T05:15:40Z
Lists: pgsql-hackers

Attachments

Greetings again.
I was looking through more static analyzer output and found another 
problem.
In ecpg/pgtypeslib/dt_common.c there are 4 calls of pgtypes_alloc.
This function uses calloc and returns NULL if OOM, but we don't check 
its
return value and immediately pass it to strcpy, which could lead to 
segfault.

I suggest adding a check for a return value since all other calls of
pgtypes_alloc are checked for NULL.

A proposed patch (with previous and current changes) is attached

Oleg Tselebrovskiy, Postgres Pro

Commits

  1. ecpg: Fix zero-termination of string generated by intoasc()

  2. ecpg: Fix error handling on OOMs when parsing timestamps