| commit | ee24b5e792e091b216db20b765d1dcb718abfdfc | |
| author | Tom Lane <tgl@sss.pgh.pa.us> | |
| Sat, 29 Apr 2023 17:06:44 +0000 (29 13:06 -0400) | ||
| committer | Tom Lane <tgl@sss.pgh.pa.us> | |
| Sat, 29 Apr 2023 17:06:44 +0000 (29 13:06 -0400) | ||
| tree | b327bd330ce17fa96d41c6d484d2df5676e746e2 | treesnapshot (tar.gz zip) |
| parent | 7dcd9998c19d7e1a86bc0d76167e429455e3db5f | commitdiff |
Tighten array dimensionality checks in Perl -> SQL array conversion.
plperl_array_to_datum() wasn't sufficiently careful about checking
that nested lists represent a rectangular array structure; it would
accept inputs such as "[1, []]". This is a bit related to the
PL/Python bug fixed in commit 81eaaf65e, but it doesn't seem to
provide any direct route to a memory stomp. Instead the likely
failure mode is for makeMdArrayResult to be passed fewer Datums than
the claimed array dimensionality requires, possibly leading to a wild
pointer dereference and SIGSEGV.
Per report from Alexander Lakhin. It's been broken for a long
time, so back-patch to all supported branches.
Discussion: https://postgr.es/m/5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com
plperl_array_to_datum() wasn't sufficiently careful about checking
that nested lists represent a rectangular array structure; it would
accept inputs such as "[1, []]". This is a bit related to the
PL/Python bug fixed in commit 81eaaf65e, but it doesn't seem to
provide any direct route to a memory stomp. Instead the likely
failure mode is for makeMdArrayResult to be passed fewer Datums than
the claimed array dimensionality requires, possibly leading to a wild
pointer dereference and SIGSEGV.
Per report from Alexander Lakhin. It's been broken for a long
time, so back-patch to all supported branches.
Discussion: https://postgr.es/m/5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com
| src/pl/plperl/expected/plperl_array.out | diffblobblamehistory | |
| src/pl/plperl/plperl.c | diffblobblamehistory | |
| src/pl/plperl/sql/plperl_array.sql | diffblobblamehistory |