Skip to content

Commit ff53890

Browse files
committed
Don't use ordinary NULL-terminated strings as Name datums.
Consumers are entitled to read the full 64 bytes pertaining to a Name; using a shorter NULL-terminated string leads to reading beyond the end its allocation; a SIGSEGV is possible. Use the frequent idiom of copying to a NameData on the stack. New in 9.3, so no back-patch.
1 parent dc3eb56 commit ff53890

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

src/backend/commands/alter.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ AlterObjectRename_internal(Relation rel, Oid objectId, const char *new_name)
168168
Datum *values;
169169
bool *nulls;
170170
bool *replaces;
171+
NameData nameattrdata;
171172

172173
oldtup = SearchSysCache1(oidCacheId, ObjectIdGetDatum(objectId));
173174
if (!HeapTupleIsValid(oldtup))
@@ -273,7 +274,8 @@ AlterObjectRename_internal(Relation rel, Oid objectId, const char *new_name)
273274
values = palloc0(RelationGetNumberOfAttributes(rel) * sizeof(Datum));
274275
nulls = palloc0(RelationGetNumberOfAttributes(rel) * sizeof(bool));
275276
replaces = palloc0(RelationGetNumberOfAttributes(rel) * sizeof(bool));
276-
values[Anum_name - 1] = PointerGetDatum(new_name);
277+
namestrcpy(&nameattrdata, new_name);
278+
values[Anum_name - 1] = NameGetDatum(&nameattrdata);
277279
replaces[Anum_name - 1] = true;
278280
newtup = heap_modify_tuple(oldtup, RelationGetDescr(rel),
279281
values, nulls, replaces);

src/backend/commands/event_trigger.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,8 @@ insert_event_trigger_tuple(char *trigname, char *eventname, Oid evtOwner,
302302
HeapTuple tuple;
303303
Datum values[Natts_pg_trigger];
304304
bool nulls[Natts_pg_trigger];
305+
NameData evtnamedata,
306+
evteventdata;
305307
ObjectAddress myself,
306308
referenced;
307309

@@ -310,8 +312,10 @@ insert_event_trigger_tuple(char *trigname, char *eventname, Oid evtOwner,
310312

311313
/* Build the new pg_trigger tuple. */
312314
memset(nulls, false, sizeof(nulls));
313-
values[Anum_pg_event_trigger_evtname - 1] = NameGetDatum(trigname);
314-
values[Anum_pg_event_trigger_evtevent - 1] = NameGetDatum(eventname);
315+
namestrcpy(&evtnamedata, trigname);
316+
values[Anum_pg_event_trigger_evtname - 1] = NameGetDatum(&evtnamedata);
317+
namestrcpy(&evteventdata, eventname);
318+
values[Anum_pg_event_trigger_evtevent - 1] = NameGetDatum(&evteventdata);
315319
values[Anum_pg_event_trigger_evtowner - 1] = ObjectIdGetDatum(evtOwner);
316320
values[Anum_pg_event_trigger_evtfoid - 1] = ObjectIdGetDatum(funcoid);
317321
values[Anum_pg_event_trigger_evtenabled - 1] =

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy