Tighten up overflow check in path_recv, pursuant to code review inspired

tglsfdc · tglsfdc · commit 4d924bdb4621 · 2004-05-12T22:38:44.000Z
by Ken Ashcraft's report.  I think there is no actual bug here since if
the int32 value does wrap a little bit, palloc will still reject it.
Still it's better that the code be obviously correct.
diff --git a/src/backend/utils/adt/geo_ops.c b/src/backend/utils/adt/geo_ops.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.83 2003/11/29 19:51:58 pgsql Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.84 2004/05/12 22:38:44 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -1383,7 +1383,7 @@ path_recv(PG_FUNCTION_ARGS)
 
 	closed = pq_getmsgbyte(buf);
 	npts = pq_getmsgint(buf, sizeof(int32));
-	if (npts < 0 || npts >= (int32) (INT_MAX / sizeof(Point)))
+	if (npts < 0 || npts >= (int32) ((INT_MAX - offsetof(PATH, p[0])) / sizeof(Point)))
 		ereport(ERROR,
 				(errcode(ERRCODE_INVALID_BINARY_REPRESENTATION),
 				 errmsg("invalid number of points in external \"path\" value")));

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@`
`8`	`8`	`*`
`9`	`9`	`*`
`10`	`10`	`* IDENTIFICATION`
`11`		`- * $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.83 2003/11/29 19:51:58 pgsql Exp $`
	`11`	`+ * $PostgreSQL: pgsql/src/backend/utils/adt/geo_ops.c,v 1.84 2004/05/12 22:38:44 tgl Exp $`
`12`	`12`	`*`
`13`	`13`	`*-------------------------------------------------------------------------`
`14`	`14`	`*/`
`@@ -1383,7 +1383,7 @@ path_recv(PG_FUNCTION_ARGS)`
`1383`	`1383`
`1384`	`1384`	`closed = pq_getmsgbyte(buf);`
`1385`	`1385`	`npts = pq_getmsgint(buf, sizeof(int32));`
`1386`		`- if (npts < 0 \|\| npts >= (int32) (INT_MAX / sizeof(Point)))`
	`1386`	`+ if (npts < 0 \|\| npts >= (int32) ((INT_MAX - offsetof(PATH, p[0])) / sizeof(Point)))`
`1387`	`1387`	`ereport(ERROR,`
`1388`	`1388`	`(errcode(ERRCODE_INVALID_BINARY_REPRESENTATION),`
`1389`	`1389`	`errmsg("invalid number of points in external \"path\" value")));`