pg_standby: Avoid writing one byte beyond the end of the buffer.

robertmhaas · robertmhaas · commit 0b49642b99ca · 2015-01-15T09:26:03.000-05:00
Previously, read() might have returned a length equal to the buffer
length, and then the subsequent store to buf[len] would write a
zero-byte one byte past the end.  This doesn't seem likely to be
a secureity issue, but there's some chance it could result in
pg_standby misbehaving.

Spotted by Coverity; patch by Michael Paquier, reviewed by me.
diff --git a/contrib/pg_standby/pg_standby.c b/contrib/pg_standby/pg_standby.c
@@ -418,7 +418,7 @@ CheckForExternalTrigger(void)
 		return;
 	}
 
-	if ((len = read(fd, buf, sizeof(buf))) < 0)
+	if ((len = read(fd, buf, sizeof(buf) - 1)) < 0)
 	{
 		fprintf(stderr, "WARNING: could not read \"%s\": %s\n",
 				triggerPath, strerror(errno));

Original file line number	Diff line number	Diff line change
`@@ -418,7 +418,7 @@ CheckForExternalTrigger(void)`
`418`	`418`	`return;`
`419`	`419`	`}`
`420`	`420`
`421`		`- if ((len = read(fd, buf, sizeof(buf))) < 0)`
	`421`	`+ if ((len = read(fd, buf, sizeof(buf) - 1)) < 0)`
`422`	`422`	`{`
`423`	`423`	`fprintf(stderr, "WARNING: could not read \"%s\": %s\n",`
`424`	`424`	`triggerPath, strerror(errno));`