Fix buffer overrun in pg_upgrade.

tglsfdc · tglsfdc · commit 71baff1786e0 · 2010-11-02T17:31:41.000-04:00
Problem reported, and cause identified, by Hernan Gonzalez.
diff --git a/contrib/pg_upgrade/controldata.c b/contrib/pg_upgrade/controldata.c
@@ -545,7 +545,7 @@ putenv2(const char *var, const char *val)
 	{
 #ifndef WIN32
 		char	   *envstr = (char *) pg_malloc(strlen(var) +
-												strlen(val) + 1);
+												strlen(val) + 2);
 
 		sprintf(envstr, "%s=%s", var, val);
 		putenv(envstr);

Original file line number	Diff line number	Diff line change
`@@ -545,7 +545,7 @@ putenv2(const char var, const char val)`
`545`	`545`	`{`
`546`	`546`	`#ifndef WIN32`
`547`	`547`	`char envstr = (char ) pg_malloc(strlen(var) +`
`548`		`- strlen(val) + 1);`
	`548`	`+ strlen(val) + 2);`
`549`	`549`
`550`	`550`	`sprintf(envstr, "%s=%s", var, val);`
`551`	`551`	`putenv(envstr);`