| commit | 4ddfbd2a8ea9b41ced0cad1d984c833085f8ce91 | |
| author | Tom Lane <tgl@sss.pgh.pa.us> | |
| Sun, 31 Jul 2022 17:43:17 +0000 (31 13:43 -0400) | ||
| committer | Tom Lane <tgl@sss.pgh.pa.us> | |
| Sun, 31 Jul 2022 17:43:17 +0000 (31 13:43 -0400) | ||
| tree | 61dc53798e7072d8af499109ef02ab6924a13081 | treesnapshot (tar.gz zip) |
| parent | bfac42ea0284f4608d1c37477db14374f4ac9e87 | commitdiff |
Fix trim_array() for zero-dimensional array argument.
The code tried to access ARR_DIMS(v)[0] and ARR_LBOUND(v)[0]
whether or not those values exist. This made the range check
on the "n" argument unstable --- it might or might not fail, and
if it did it would report garbage for the allowed upper limit.
These bogus accesses would probably annoy Valgrind, and if you
were very unlucky even lead to SIGSEGV.
Report and fix by Martin Kalcher. Back-patch to v14 where this
function was added.
Discussion: https://postgr.es/m/baaeb413-b8a8-4656-5757-ef347e5ec11f@aboutsource.net
The code tried to access ARR_DIMS(v)[0] and ARR_LBOUND(v)[0]
whether or not those values exist. This made the range check
on the "n" argument unstable --- it might or might not fail, and
if it did it would report garbage for the allowed upper limit.
These bogus accesses would probably annoy Valgrind, and if you
were very unlucky even lead to SIGSEGV.
Report and fix by Martin Kalcher. Back-patch to v14 where this
function was added.
Discussion: https://postgr.es/m/baaeb413-b8a8-4656-5757-ef347e5ec11f@aboutsource.net
| src/backend/utils/adt/arrayfuncs.c | diffblobblamehistory | |
| src/test/regress/expected/arrays.out | diffblobblamehistory | |
| src/test/regress/sql/arrays.sql | diffblobblamehistory |