While I was running some tests in psql, trying to figure out how to change

bmomjian · bmomjian · commit f96babac12cd · 1999-07-20T17:20:43.000Z
the query string to handle any length, I discovered that under certain
conditions, psql will core dump when handling long strings.  Thus, the
patch.  It was caused by a buffer overrun, probably not noticeable in a lot
of cases, but pretty noticeable in mine.

Problem was caused by the fact that the length check is only performed after
the check for a ; to get the end of the query and execute.

Cheers...

MikeA
diff --git a/src/bin/psql/psql.c b/src/bin/psql/psql.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *	  $Header: /cvsroot/pgsql/src/bin/psql/Attic/psql.c,v 1.187 1999/07/19 21:06:19 momjian Exp $
+ *	  $Header: /cvsroot/pgsql/src/bin/psql/Attic/psql.c,v 1.188 1999/07/20 17:20:43 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -2705,7 +2705,8 @@ MainLoop(PsqlSettings *pset, char *query, FILE *source)
 					char		hold_char = line[i + thislen];
 
 					line[i + thislen] = '\0';
-					if (query_start[0] != '\0')
+					if ((query_start[0] != '\0') &&
+						(strlen(query) + strlen(query_start) <= MAX_QUERY_BUFFER))
 					{
 						if (query[0] != '\0')
 						{

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`*`
`8`	`8`	`*`
`9`	`9`	`* IDENTIFICATION`
`10`		`- * $Header: /cvsroot/pgsql/src/bin/psql/Attic/psql.c,v 1.187 1999/07/19 21:06:19 momjian Exp $`
	`10`	`+ * $Header: /cvsroot/pgsql/src/bin/psql/Attic/psql.c,v 1.188 1999/07/20 17:20:43 momjian Exp $`
`11`	`11`	`*`
`12`	`12`	`*-------------------------------------------------------------------------`
`13`	`13`	`*/`
`@@ -2705,7 +2705,8 @@ MainLoop(PsqlSettings pset, char query, FILE *source)`
`2705`	`2705`	`char hold_char = line[i + thislen];`
`2706`	`2706`
`2707`	`2707`	`line[i + thislen] = '\0';`
`2708`		`- if (query_start[0] != '\0')`
	`2708`	`+ if ((query_start[0] != '\0') &&`
	`2709`	`+ (strlen(query) + strlen(query_start) <= MAX_QUERY_BUFFER))`
`2709`	`2710`	`{`
`2710`	`2711`	`if (query[0] != '\0')`
`2711`	`2712`	`{`