| From: | tgl(at)postgresql(dot)org (Tom Lane) |
|---|---|
| To: | pgsql-committers(at)postgresql(dot)org |
| Subject: | pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator |
| Date: | 2009-07-10 00:32:00 |
| Message-ID: | 20090710003200.4E86B75331E@cvs.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Log Message:
-----------
Fix xslt_process() to ensure that it inserts a NULL terminator after the
last pair of parameter name/value strings, even when there are MAXPARAMS
of them. Aboriginal bug in contrib/xml2, noted while studying bug #4912
(though I'm not sure whether there's something else involved in that
report).
This might be thought a security issue, since it's a potential backend
crash; but considering that untrustworthy users shouldn't be allowed
to get their hands on xslt_process() anyway, it's probably not worth
getting excited about.
Modified Files:
--------------
pgsql/contrib/xml2:
xslt_proc.c (r1.15 -> r1.16)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/contrib/xml2/xslt_proc.c?r1=1.15&r2=1.16)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2009-07-10 00:32:06 | pgsql: Fix xslt_process() to ensure that it inserts a NULL terminator |
| Previous Message | User Dim | 2009-07-09 14:55:43 | prefix - prefix: debian section is now database |