pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator

From: tgl(at)postgresql(dot)org (Tom Lane)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator
Date: 2009-07-10 00:32:29
Message-ID: 20090710003229.816A675331E@cvs.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log Message:
-----------
Fix xslt_process() to ensure that it inserts a NULL terminator after the
last pair of parameter name/value strings, even when there are MAXPARAMS
of them. Aboriginal bug in contrib/xml2, noted while studying bug #4912
(though I'm not sure whether there's something else involved in that
report).

This might be thought a security issue, since it's a potential backend
crash; but considering that untrustworthy users shouldn't be allowed
to get their hands on xslt_process() anyway, it's probably not worth
getting excited about.

Tags:
----
REL8_0_STABLE

Modified Files:
--------------
pgsql/contrib/xml2:
xslt_proc.c (r1.3 -> r1.3.4.1)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/contrib/xml2/xslt_proc.c?r1=1.3&r2=1.3.4.1)

Browse pgsql-committers by date

  From Date Subject
Next Message User Bloodnok 2009-07-10 22:40:21 veil - veil: Minor documentation fix
Previous Message Tom Lane 2009-07-10 00:32:23 pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator