Add error-throwing wrappers for the printf family of functions.

All known standard library implementations of these functions can fail
with ENOMEM.  A caller neglecting to check for failure would experience
missing output, information exposure, or a crash.  Check return values
within wrappers and code, currently just snprintf.c, that bypasses the
wrappers.  The wrappers do not return after an error, so their callers
need not check.  Back-patch to 9.0 (all supported versions).

Popular free software standard library implementations do take pains to
bypass malloc() in simple cases, but they risk ENOMEM for floating point
numbers, positional arguments, large field widths, and large precisions.
No specification demands such caution, so this commit regards every call
to a printf family function as a potential threat.

Injecting the wrappers implicitly is a compromise between patch scope
and design goals.  I would prefer to edit each call site to name a
wrapper explicitly.  libpq and the ECPG libraries would, ideally, convey
errors to the caller rather than abort().  All that would be painfully
invasive for a back-patched security fix, hence this compromise.

Security: CVE-2015-3166

diff --git a/src/include/port.h b/src/include/port.h
index 9c07898458a1c11cb2bb32f328f41bbcfc2914e1..4f2c654c68d6ad78539ee5b184db02133ee0e546 100644 (file)
--- a/src/include/port.h
+++ b/src/include/port.h
@@ -156,12 +156,11 @@ extern unsigned char pg_tolower(unsigned char ch);
 extern unsigned char pg_ascii_toupper(unsigned char ch);
 extern unsigned char pg_ascii_tolower(unsigned char ch);
 
-#ifdef USE_REPL_SNPRINTF
-
 /*
- * Versions of libintl >= 0.13 try to replace printf() and friends with
- * macros to their own versions that understand the %$ format.  We do the
- * same, so disable their macros, if they exist.
+ * Capture macro-compatible calls to printf() and friends, and redirect them
+ * to wrappers that throw errors in lieu of reporting failure in a return
+ * value.  Versions of libintl >= 0.13 similarly redirect to versions that
+ * understand the %$ format, so disable libintl macros first.
  */
 #ifdef vsnprintf
 #undef vsnprintf
@@ -185,6 +184,55 @@ extern unsigned char pg_ascii_tolower(unsigned char ch);
 #undef printf
 #endif
 
+extern int
+vsnprintf_throw_on_fail(char *str, size_t count, const char *fmt, va_list args)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 3, 0)));
+extern int
+snprintf_throw_on_fail(char *str, size_t count, const char *fmt,...)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 3, 4)));
+extern int
+vsprintf_throw_on_fail(char *str, const char *fmt, va_list args)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 2, 0)));
+extern int
+sprintf_throw_on_fail(char *str, const char *fmt,...)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 2, 3)));
+extern int
+vfprintf_throw_on_fail(FILE *stream, const char *fmt, va_list args)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 2, 0)));
+extern int
+fprintf_throw_on_fail(FILE *stream, const char *fmt,...)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 2, 3)));
+extern int
+printf_throw_on_fail(const char *fmt,...)
+__attribute__((format(PG_PRINTF_ATTRIBUTE, 1, 2)));
+
+/*
+ * The GCC-specific code below prevents the __attribute__(... 'printf')
+ * above from being replaced, and this is required because gcc doesn't
+ * know anything about printf_throw_on_fail.
+ */
+#ifdef __GNUC__
+#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__)
+#define snprintf(...)  snprintf_throw_on_fail(__VA_ARGS__)
+#define vsprintf(...)  vsprintf_throw_on_fail(__VA_ARGS__)
+#define sprintf(...)   sprintf_throw_on_fail(__VA_ARGS__)
+#define vfprintf(...)  vfprintf_throw_on_fail(__VA_ARGS__)
+#define fprintf(...)   fprintf_throw_on_fail(__VA_ARGS__)
+#define printf(...)        printf_throw_on_fail(__VA_ARGS__)
+#else
+#define vsnprintf      vsnprintf_throw_on_fail
+#define snprintf       snprintf_throw_on_fail
+#define vsprintf       vsprintf_throw_on_fail
+#define sprintf            sprintf_throw_on_fail
+#define vfprintf       vfprintf_throw_on_fail
+#define fprintf            fprintf_throw_on_fail
+#define printf         printf_throw_on_fail
+#endif
+
+#ifdef USE_REPL_SNPRINTF
+
+/* Code outside syswrap.c should not call these. */
+
 extern int pg_vsnprintf(char *str, size_t count, const char *fmt, va_list args);
 extern int
 pg_snprintf(char *str, size_t count, const char *fmt,...)
@@ -205,28 +253,6 @@ pg_printf(const char *fmt,...)
 /* This extension allows gcc to check the format string */
 __attribute__((format(PG_PRINTF_ATTRIBUTE, 1, 2)));
 
-/*
- * The GCC-specific code below prevents the __attribute__(... 'printf')
- * above from being replaced, and this is required because gcc doesn't
- * know anything about pg_printf.
- */
-#ifdef __GNUC__
-#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
-#define snprintf(...)  pg_snprintf(__VA_ARGS__)
-#define vsprintf(...)  pg_vsprintf(__VA_ARGS__)
-#define sprintf(...)   pg_sprintf(__VA_ARGS__)
-#define vfprintf(...)  pg_vfprintf(__VA_ARGS__)
-#define fprintf(...)   pg_fprintf(__VA_ARGS__)
-#define printf(...)        pg_printf(__VA_ARGS__)
-#else
-#define vsnprintf      pg_vsnprintf
-#define snprintf       pg_snprintf
-#define vsprintf       pg_vsprintf
-#define sprintf            pg_sprintf
-#define vfprintf       pg_vfprintf
-#define fprintf            pg_fprintf
-#define printf         pg_printf
-#endif
 #endif   /* USE_REPL_SNPRINTF */
 
 #if defined(WIN32)

diff --git a/src/interfaces/ecpg/compatlib/Makefile b/src/interfaces/ecpg/compatlib/Makefile
index ca489d32b94d6c6eec4bc21fe2b048dc8f97f371..731148a782e625159e7aaa2512509e7a0d1d2eb0 100644 (file)
--- a/src/interfaces/ecpg/compatlib/Makefile
+++ b/src/interfaces/ecpg/compatlib/Makefile
@@ -47,6 +47,7 @@ submake-pgtypeslib:
 # Shared library stuff
 include $(top_srcdir)/src/Makefile.shlib
 
+# XXX This library uses no symbols from snprintf.c.
 snprintf.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 

diff --git a/src/interfaces/ecpg/ecpglib/.gitignore b/src/interfaces/ecpg/ecpglib/.gitignore
index 351f43775e88f429366baa689272aa6144d3bae6..9d994c160d407d6664857733fa6cdaeb1000433d 100644 (file)
--- a/src/interfaces/ecpg/ecpglib/.gitignore
+++ b/src/interfaces/ecpg/ecpglib/.gitignore
@@ -5,4 +5,5 @@
 /path.c
 /pgstrcasecmp.c
 /strlcpy.c
+/syswrap.c
 /thread.c

diff --git a/src/interfaces/ecpg/ecpglib/Makefile b/src/interfaces/ecpg/ecpglib/Makefile
index 86dbdc221459bd1750d081943335f8b0103204b8..e0b6c42487a2c7d366a700d003276614a5175339 100644 (file)
--- a/src/interfaces/ecpg/ecpglib/Makefile
+++ b/src/interfaces/ecpg/ecpglib/Makefile
@@ -25,7 +25,7 @@ override CFLAGS += $(PTHREAD_CFLAGS)
 LIBS := $(filter-out -lpgport, $(LIBS))
 
 OBJS= execute.o typename.o descriptor.o sqlda.o data.o error.o prepare.o memory.o \
-   connect.o misc.o path.o pgstrcasecmp.o \
+   connect.o misc.o path.o pgstrcasecmp.o syswrap.o \
    $(filter snprintf.o strlcpy.o win32setlocale.o isinf.o, $(LIBOBJS))
 
 # thread.c is needed only for non-WIN32 implementation of path.c
@@ -59,7 +59,7 @@ include $(top_srcdir)/src/Makefile.shlib
 # necessarily use the same object files as the backend uses. Instead,
 # symlink the source files in here and build our own object file.
 
-path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c win32setlocale.c isinf.c: % : $(top_srcdir)/src/port/%
+path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c win32setlocale.c isinf.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 misc.o: misc.c $(top_builddir)/src/port/pg_config_paths.h
@@ -76,6 +76,6 @@ uninstall: uninstall-lib
 
 clean distclean: clean-lib
    rm -f $(OBJS)
-   rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c win32setlocale.c
+   rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c win32setlocale.c
 
 maintainer-clean: distclean maintainer-clean-lib

diff --git a/src/interfaces/ecpg/pgtypeslib/.gitignore b/src/interfaces/ecpg/pgtypeslib/.gitignore
index 4ee58ea957eed2d6b40c2b57ae2fca40f8509284..4f97502100e7d5c144128caf65d66fe9082908f4 100644 (file)
--- a/src/interfaces/ecpg/pgtypeslib/.gitignore
+++ b/src/interfaces/ecpg/pgtypeslib/.gitignore
@@ -3,3 +3,4 @@
 /exports.list
 
 /pgstrcasecmp.c
+/syswrap.c

diff --git a/src/interfaces/ecpg/pgtypeslib/Makefile b/src/interfaces/ecpg/pgtypeslib/Makefile
index 340bef398bd9b8a57bb178163ec17746f541f8ad..a61245397969f49ffcea96222c8f980986e7aad6 100644 (file)
--- a/src/interfaces/ecpg/pgtypeslib/Makefile
+++ b/src/interfaces/ecpg/pgtypeslib/Makefile
@@ -29,7 +29,7 @@ SHLIB_LINK += -lm
 SHLIB_EXPORTS = exports.txt
 
 OBJS= numeric.o datetime.o common.o dt_common.o timestamp.o interval.o \
-   pgstrcasecmp.o \
+   pgstrcasecmp.o syswrap.o \
    $(filter rint.o snprintf.o, $(LIBOBJS))
 
 all: all-lib
@@ -42,7 +42,7 @@ include $(top_srcdir)/src/Makefile.shlib
 # necessarily use the same object files as the backend uses. Instead,
 # symlink the source files in here and build our own object file.
 
-pgstrcasecmp.c rint.c snprintf.c: % : $(top_srcdir)/src/port/%
+pgstrcasecmp.c rint.c snprintf.c syswrap.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 install: all installdirs install-lib
@@ -52,6 +52,6 @@ installdirs: installdirs-lib
 uninstall: uninstall-lib
 
 clean distclean: clean-lib
-   rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c
+   rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c syswrap.c
 
 maintainer-clean: distclean maintainer-clean-lib

diff --git a/src/interfaces/libpq/.gitignore b/src/interfaces/libpq/.gitignore
index 9bd4177101c9b875834d893f827ecb2d523346da..12566fe07310f0f7ae267eebe992e6a9fa457f9d 100644 (file)
--- a/src/interfaces/libpq/.gitignore
+++ b/src/interfaces/libpq/.gitignore
@@ -12,6 +12,7 @@
 /snprintf.c
 /strerror.c
 /strlcpy.c
+/syswrap.c
 /thread.c
 /win32error.c
 /win32setlocale.c

diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefile
index fdb30302aecfd680a488239a33b2e53ba24d25c6..6cb6a5293e7e68d271af272e7018c27c0122f2b5 100644 (file)
--- a/src/interfaces/libpq/Makefile
+++ b/src/interfaces/libpq/Makefile
@@ -36,7 +36,7 @@ OBJS= fe-auth.o fe-connect.o fe-exec.o fe-misc.o fe-print.o fe-lobj.o \
    libpq-events.o
 # libpgport C files we always use
 OBJS += chklocale.o inet_net_ntop.o noblock.o pgstrcasecmp.o pqsignal.o \
-   thread.o
+   syswrap.o thread.o
 # libpgport C files that are needed if identified by configure
 OBJS += $(filter crypt.o getaddrinfo.o getpeereid.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o win32setlocale.o, $(LIBOBJS))
 # backend/libpq
@@ -89,7 +89,7 @@ backend_src = $(top_srcdir)/src/backend
 # For some libpgport modules, this only happens if configure decides
 # the module is needed (see filter hack in OBJS, above).
 
-chklocale.c crypt.c getaddrinfo.c getpeereid.c inet_aton.c inet_net_ntop.c noblock.c open.c pgsleep.c pgstrcasecmp.c pqsignal.c snprintf.c strerror.c strlcpy.c thread.c win32error.c win32setlocale.c: % : $(top_srcdir)/src/port/%
+chklocale.c crypt.c getaddrinfo.c getpeereid.c inet_aton.c inet_net_ntop.c noblock.c open.c pgsleep.c pgstrcasecmp.c pqsignal.c snprintf.c strerror.c strlcpy.c syswrap.c thread.c win32error.c win32setlocale.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 ip.c md5.c: % : $(backend_src)/libpq/%
@@ -150,7 +150,7 @@ clean distclean: clean-lib
 # Might be left over from a Win32 client-only build
    rm -f pg_config_paths.h
    rm -f inet_net_ntop.c noblock.c pgstrcasecmp.c pqsignal.c thread.c
-   rm -f chklocale.c crypt.c getaddrinfo.c getpeereid.c inet_aton.c open.c snprintf.c strerror.c strlcpy.c win32error.c win32setlocale.c
+   rm -f chklocale.c crypt.c getaddrinfo.c getpeereid.c inet_aton.c open.c snprintf.c strerror.c strlcpy.c syswrap.c win32error.c win32setlocale.c
    rm -f pgsleep.c
    rm -f md5.c ip.c
    rm -f encnames.c wchar.c

diff --git a/src/interfaces/libpq/bcc32.mak b/src/interfaces/libpq/bcc32.mak
index 8f5cd8de470d24f6f39f629c24bbcd0a6324c0f7..31944b18b05b9fb0b39a7c03c4ff33f0cdd0b6ea 100644 (file)
--- a/src/interfaces/libpq/bcc32.mak
+++ b/src/interfaces/libpq/bcc32.mak
@@ -106,6 +106,7 @@ CLEAN :
    -@erase "$(INTDIR)\dirmod.obj"
    -@erase "$(INTDIR)\pgsleep.obj"
    -@erase "$(INTDIR)\open.obj"
+   -@erase "$(INTDIR)\syswrap.obj"
    -@erase "$(INTDIR)\win32error.obj"
    -@erase "$(OUTDIR)\$(OUTFILENAME).lib"
    -@erase "$(OUTDIR)\$(OUTFILENAME)dll.lib"
@@ -149,6 +150,7 @@ LIB32_OBJS= \
    "$(INTDIR)\dirmod.obj" \
    "$(INTDIR)\pgsleep.obj" \
    "$(INTDIR)\open.obj" \
+   "$(INTDIR)\syswrap.obj" \
    "$(INTDIR)\win32error.obj" \
    "$(INTDIR)\pthread-win32.obj"
 
@@ -295,6 +297,11 @@ LINK32_FLAGS = -Gn -L$(BCB)\lib;$(INTDIR); -x -Tpd -v
    $(CPP_PROJ) /I"." ..\..\port\open.c
 <<
 
+"$(INTDIR)\syswrap.obj" : ..\..\port\syswrap.c
+   $(CPP) @<<
+   $(CPP_PROJ) ..\..\port\syswrap.c
+<<
+
 "$(INTDIR)\win32error.obj" : ..\..\port\win32error.c
    $(CPP) @<<
    $(CPP_PROJ) /I"." ..\..\port\win32error.c

diff --git a/src/interfaces/libpq/win32.mak b/src/interfaces/libpq/win32.mak
index ee1884fe201125c9ba1b2d260a879596a0efb174..3b703994374d1f521637e85e783e1d788d54ca7b 100644 (file)
--- a/src/interfaces/libpq/win32.mak
+++ b/src/interfaces/libpq/win32.mak
@@ -113,6 +113,7 @@ CLEAN :
    -@erase "$(INTDIR)\dirmod.obj"
    -@erase "$(INTDIR)\pgsleep.obj"
    -@erase "$(INTDIR)\open.obj"
+   -@erase "$(INTDIR)\syswrap.obj"
    -@erase "$(INTDIR)\win32error.obj"
    -@erase "$(INTDIR)\win32setlocale.obj"
    -@erase "$(OUTDIR)\$(OUTFILENAME).lib"
@@ -159,6 +160,7 @@ LIB32_OBJS= \
    "$(INTDIR)\dirmod.obj" \
    "$(INTDIR)\pgsleep.obj" \
    "$(INTDIR)\open.obj" \
+   "$(INTDIR)\syswrap.obj" \
    "$(INTDIR)\win32error.obj" \
    "$(INTDIR)\win32setlocale.obj" \
    "$(INTDIR)\pthread-win32.obj"
@@ -335,6 +337,11 @@ LINK32_OBJS= \
    $(CPP_PROJ) /I"." ..\..\port\open.c
 <<
 
+"$(INTDIR)\syswrap.obj" : ..\..\port\syswrap.c
+   $(CPP) @<<
+   $(CPP_PROJ) ..\..\port\syswrap.c
+<<
+
 "$(INTDIR)\win32error.obj" : ..\..\port\win32error.c
    $(CPP) @<<
    $(CPP_PROJ) /I"." ..\..\port\win32error.c

diff --git a/src/pl/plperl/plperl.h b/src/pl/plperl/plperl.h
index c86b47e9d237b9f5a9ec3caa154d3d22dbd2e483..208d79571bb5ad40153d43771a0d05893507a6a1 100644 (file)
--- a/src/pl/plperl/plperl.h
+++ b/src/pl/plperl/plperl.h
@@ -39,10 +39,8 @@
  * So we undefine them here and redefine them after it's done its dirty deed.
  */
 
-#ifdef USE_REPL_SNPRINTF
 #undef snprintf
 #undef vsnprintf
-#endif
 
 
 /* required for perl API */
@@ -51,7 +49,6 @@
 #include "XSUB.h"
 
 /* put back our snprintf and vsnprintf */
-#ifdef USE_REPL_SNPRINTF
 #ifdef snprintf
 #undef snprintf
 #endif
@@ -59,13 +56,12 @@
 #undef vsnprintf
 #endif
 #ifdef __GNUC__
-#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
-#define snprintf(...)  pg_snprintf(__VA_ARGS__)
+#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__)
+#define snprintf(...)  snprintf_throw_on_fail(__VA_ARGS__)
 #else
-#define vsnprintf      pg_vsnprintf
-#define snprintf       pg_snprintf
+#define vsnprintf      vsnprintf_throw_on_fail
+#define snprintf       snprintf_throw_on_fail
 #endif   /* __GNUC__ */
-#endif   /* USE_REPL_SNPRINTF */
 
 /* perl version and platform portability */
 #define NEED_eval_pv

diff --git a/src/pl/plpython/plpython.h b/src/pl/plpython/plpython.h
index 795231c45d33621a233427ce4a3486e14f0a1fc8..8f0a27f351f9cdc69b5b421b76a8954dafdf6701 100644 (file)
--- a/src/pl/plpython/plpython.h
+++ b/src/pl/plpython/plpython.h
@@ -35,10 +35,8 @@
  * So we undefine them here and redefine them after it's done its dirty deed.
  */
 
-#ifdef USE_REPL_SNPRINTF
 #undef snprintf
 #undef vsnprintf
-#endif
 
 #if defined(_MSC_VER) && defined(_DEBUG)
 /* Python uses #pragma to bring in a non-default libpython on VC++ if
@@ -124,7 +122,6 @@ typedef int Py_ssize_t;
 #include <eval.h>
 
 /* put back our snprintf and vsnprintf */
-#ifdef USE_REPL_SNPRINTF
 #ifdef snprintf
 #undef snprintf
 #endif
@@ -132,13 +129,12 @@ typedef int Py_ssize_t;
 #undef vsnprintf
 #endif
 #ifdef __GNUC__
-#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
-#define snprintf(...)  pg_snprintf(__VA_ARGS__)
+#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__)
+#define snprintf(...)  snprintf_throw_on_fail(__VA_ARGS__)
 #else
-#define vsnprintf              pg_vsnprintf
-#define snprintf               pg_snprintf
+#define vsnprintf      vsnprintf_throw_on_fail
+#define snprintf       snprintf_throw_on_fail
 #endif   /* __GNUC__ */
-#endif   /* USE_REPL_SNPRINTF */
 
 /*
  * Used throughout, and also by the Python 2/3 porting layer, so it's easier to

diff --git a/src/port/Makefile b/src/port/Makefile
index 3a26006b7c1a2031fc374259d5db1b856825ecee..ec8651440cc71a7bfa4f940a40178d21a65d2c4f 100644 (file)
--- a/src/port/Makefile
+++ b/src/port/Makefile
@@ -33,7 +33,7 @@ LIBS += $(PTHREAD_LIBS)
 OBJS = $(LIBOBJS) chklocale.o dirmod.o erand48.o exec.o fls.o inet_net_ntop.o \
    noblock.o path.o pgcheckdir.o pg_crc.o pgmkdirp.o pgsleep.o \
    pgstrcasecmp.o pqsignal.o \
-   qsort.o qsort_arg.o quotes.o sprompt.o tar.o thread.o \
+   qsort.o qsort_arg.o quotes.o sprompt.o syswrap.o tar.o thread.o \
    wait_error.o
 
 # foo_srv.o and foo.o are both built from foo.c, but only foo.o has -DFRONTEND

diff --git a/src/port/snprintf.c b/src/port/snprintf.c
index e53356ff383239a742722c9407be6e24f1904cef..9dfb57599eeaf1827b570429bd72b9d844c90eaa 100644 (file)
--- a/src/port/snprintf.c
+++ b/src/port/snprintf.c
@@ -114,6 +114,7 @@ typedef struct
    /* bufend == NULL is for sprintf, where we assume buf is big enough */
    FILE       *stream;         /* eventual output destination, or NULL */
    int         nchars;         /* # chars already sent to stream */
+   bool        failed;         /* call is a failure; errno is set */
 } PrintfTarget;
 
 /*
@@ -143,7 +144,7 @@ typedef union
 
 
 static void flushbuffer(PrintfTarget *target);
-static int dopr(PrintfTarget *target, const char *format, va_list args);
+static void dopr(PrintfTarget *target, const char *format, va_list args);
 
 
 int
@@ -157,14 +158,10 @@ pg_vsnprintf(char *str, size_t count, const char *fmt, va_list args)
    target.bufend = str + count - 1;
    target.stream = NULL;
    /* target.nchars is unused in this case */
-   if (dopr(&target, fmt, args))
-   {
-       *(target.bufptr) = '\0';
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    *(target.bufptr) = '\0';
-   return target.bufptr - target.bufstart;
+   return target.failed ? -1 : (target.bufptr - target.bufstart);
 }
 
 int
@@ -190,14 +187,10 @@ pg_vsprintf(char *str, const char *fmt, va_list args)
    target.bufend = NULL;
    target.stream = NULL;
    /* target.nchars is unused in this case */
-   if (dopr(&target, fmt, args))
-   {
-       *(target.bufptr) = '\0';
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    *(target.bufptr) = '\0';
-   return target.bufptr - target.bufstart;
+   return target.failed ? -1 : (target.bufptr - target.bufstart);
 }
 
 int
@@ -227,14 +220,11 @@ pg_vfprintf(FILE *stream, const char *fmt, va_list args)
    target.bufend = buffer + sizeof(buffer) - 1;
    target.stream = stream;
    target.nchars = 0;
-   if (dopr(&target, fmt, args))
-   {
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    /* dump any remaining buffer contents */
    flushbuffer(&target);
-   return target.nchars;
+   return target.failed ? -1 : target.nchars;
 }
 
 int
@@ -261,14 +251,24 @@ pg_printf(const char *fmt,...)
    return len;
 }
 
-/* call this only when stream is defined */
+/*
+ * Attempt to write the entire buffer to target->stream; discard the entire
+ * buffer in any case.  Call this only when target->stream is defined.
+ */
 static void
 flushbuffer(PrintfTarget *target)
 {
    size_t      nc = target->bufptr - target->bufstart;
 
-   if (nc > 0)
-       target->nchars += fwrite(target->bufstart, 1, nc, target->stream);
+   if (!target->failed && nc > 0)
+   {
+       size_t      written;
+
+       written = fwrite(target->bufstart, 1, nc, target->stream);
+       target->nchars += written;
+       if (written != nc)
+           target->failed = true;
+   }
    target->bufptr = target->bufstart;
 }
 
@@ -295,7 +295,7 @@ static void trailing_pad(int *padlen, PrintfTarget *target);
 /*
  * dopr(): poor man's version of doprintf
  */
-static int
+static void
 dopr(PrintfTarget *target, const char *format, va_list args)
 {
    const char *format_start = format;
@@ -372,12 +372,12 @@ nextch1:
            case '$':
                have_dollar = true;
                if (accum <= 0 || accum > NL_ARGMAX)
-                   return -1;
+                   goto bad_format;
                if (afterstar)
                {
                    if (argtypes[accum] &&
                        argtypes[accum] != ATYPE_INT)
-                       return -1;
+                       goto bad_format;
                    argtypes[accum] = ATYPE_INT;
                    last_dollar = Max(last_dollar, accum);
                    afterstar = false;
@@ -414,7 +414,7 @@ nextch1:
                        atype = ATYPE_INT;
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != atype)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = atype;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -426,7 +426,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_INT)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_INT;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -439,7 +439,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_CHARPTR)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_CHARPTR;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -455,7 +455,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_DOUBLE)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_DOUBLE;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -476,7 +476,7 @@ nextch1:
 
    /* Per spec, you use either all dollar or all not. */
    if (have_dollar && have_non_dollar)
-       return -1;
+       goto bad_format;
 
    /*
     * In dollar mode, collect the arguments in physical order.
@@ -486,7 +486,7 @@ nextch1:
        switch (argtypes[i])
        {
            case ATYPE_NONE:
-               return -1;      /* invalid format */
+               goto bad_format;
            case ATYPE_INT:
                argvalues[i].i = va_arg(args, int);
                break;
@@ -511,6 +511,9 @@ nextch1:
    format = format_start;
    while ((ch = *format++) != '\0')
    {
+       if (target->failed)
+           break;
+
        if (ch != '%')
        {
            dopr_outch(ch, target);
@@ -755,7 +758,11 @@ nextch2:
        }
    }
 
-   return 0;
+   return;
+
+bad_format:
+   errno = EINVAL;
+   target->failed = true;
 }
 
 static size_t
@@ -805,8 +812,10 @@ fmtptr(void *value, PrintfTarget *target)
 
    /* we rely on regular C library's sprintf to do the basic conversion */
    vallen = sprintf(convert, "%p", value);
-
-   dostr(convert, vallen, target);
+   if (vallen < 0)
+       target->failed = true;
+   else
+       dostr(convert, vallen, target);
 }
 
 static void
@@ -939,16 +948,19 @@ fmtfloat(double value, char type, int forcesign, int leftjust,
 
    if (pointflag)
    {
-       sprintf(fmt, "%%.%d%c", prec, type);
+       if (sprintf(fmt, "%%.%d%c", prec, type) < 0)
+           goto fail;
        zeropadlen = precision - prec;
    }
-   else
-       sprintf(fmt, "%%%c", type);
+   else if (sprintf(fmt, "%%%c", type) < 0)
+       goto fail;
 
    if (!isnan(value) && adjust_sign((value < 0), forcesign, &signvalue))
        value = -value;
 
    vallen = sprintf(convert, fmt, value);
+   if (vallen < 0)
+       goto fail;
 
    /* If it's infinity or NaN, forget about doing any zero-padding */
    if (zeropadlen > 0 && !isdigit((unsigned char) convert[vallen - 1]))
@@ -988,6 +1000,10 @@ fmtfloat(double value, char type, int forcesign, int leftjust,
    }
 
    trailing_pad(&padlen, target);
+   return;
+
+fail:
+   target->failed = true;
 }
 
 static void

diff --git a/src/port/syswrap.c b/src/port/syswrap.c
new file mode 100644 (file)
index 0000000..8415a33
--- /dev/null
+++ b/src/port/syswrap.c
@@ -0,0 +1,155 @@
+/*-------------------------------------------------------------------------
+ *
+ * syswrap.c
+ *   error-throwing wrappers around POSIX functions that rarely fail
+ *
+ * Portions Copyright (c) 1996-2015, PostgreSQL Global Development Group
+ *
+ *
+ * IDENTIFICATION
+ *   src/port/syswrap.c
+ *
+ *-------------------------------------------------------------------------
+ */
+
+#ifndef FRONTEND
+#include "postgres.h"
+#else
+#include "postgres_fe.h"
+#endif
+
+/* Prevent recursion */
+#undef vsnprintf
+#undef snprintf
+#undef vsprintf
+#undef sprintf
+#undef vfprintf
+#undef fprintf
+#undef printf
+
+/* When the libc primitives are lacking, use our own. */
+#ifdef USE_REPL_SNPRINTF
+#ifdef __GNUC__
+#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
+#define snprintf(...)  pg_snprintf(__VA_ARGS__)
+#define vsprintf(...)  pg_vsprintf(__VA_ARGS__)
+#define sprintf(...)   pg_sprintf(__VA_ARGS__)
+#define vfprintf(...)  pg_vfprintf(__VA_ARGS__)
+#define fprintf(...)   pg_fprintf(__VA_ARGS__)
+#define printf(...)        pg_printf(__VA_ARGS__)
+#else
+#define vsnprintf      pg_vsnprintf
+#define snprintf       pg_snprintf
+#define vsprintf       pg_vsprintf
+#define sprintf            pg_sprintf
+#define vfprintf       pg_vfprintf
+#define fprintf            pg_fprintf
+#define printf         pg_printf
+#endif
+#endif   /* USE_REPL_SNPRINTF */
+
+/*
+ * We abort() in the frontend, rather than exit(), because libpq in particular
+ * has no business calling exit().  These failures had better be rare.
+ */
+#ifdef FRONTEND
+#define LIB_ERR(func) \
+do { \
+   int discard = fprintf(stderr, "%s failed: %s\n", func, strerror(errno)); \
+   (void) discard; \
+   abort(); \
+} while (0)
+#else
+#define LIB_ERR(func) elog(ERROR, "%s failed: %m", func)
+#endif
+
+int
+vsnprintf_throw_on_fail(char *str, size_t count, const char *fmt, va_list args)
+{
+   int         save_errno;
+   int         ret;
+
+   /*
+    * On HP-UX B.11.31, a call that truncates output returns -1 without
+    * setting errno.  (SUSv2 allowed this until the approval of Base Working
+    * Group Resolution BWG98-006.)  We could avoid the save and restore of
+    * errno on most platforms.
+    */
+   save_errno = errno;
+   errno = 0;
+   ret = vsnprintf(str, count, fmt, args);
+   if (ret < 0 && errno != 0)
+       LIB_ERR("vsnprintf");
+   errno = save_errno;
+   return ret;
+}
+
+int
+snprintf_throw_on_fail(char *str, size_t count, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vsnprintf_throw_on_fail(str, count, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+vsprintf_throw_on_fail(char *str, const char *fmt, va_list args)
+{
+   int         ret;
+
+   ret = vsprintf(str, fmt, args);
+   if (ret < 0)
+       LIB_ERR("vsprintf");
+   return ret;
+}
+
+int
+sprintf_throw_on_fail(char *str, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vsprintf_throw_on_fail(str, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+vfprintf_throw_on_fail(FILE *stream, const char *fmt, va_list args)
+{
+   int         ret;
+
+   ret = vfprintf(stream, fmt, args);
+   if (ret < 0)
+       LIB_ERR("vfprintf");
+   return ret;
+}
+
+int
+fprintf_throw_on_fail(FILE *stream, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vfprintf_throw_on_fail(stream, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+printf_throw_on_fail(const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vfprintf_throw_on_fail(stdout, fmt, args);
+   va_end(args);
+   return ret;
+}

diff --git a/src/tools/msvc/Mkvcbuild.pm b/src/tools/msvc/Mkvcbuild.pm
index 3782ec53a231ca2fa25b1f37182d09f29bdb084c..894f9638502302814fe4a98a3a2f0bd2298925ce 100644 (file)
--- a/src/tools/msvc/Mkvcbuild.pm
+++ b/src/tools/msvc/Mkvcbuild.pm
@@ -70,7 +70,7 @@ sub mkvcbuild
      erand48.c snprintf.c strlcat.c strlcpy.c dirmod.c exec.c noblock.c path.c
      pgcheckdir.c pg_crc.c pgmkdirp.c pgsleep.c pgstrcasecmp.c pqsignal.c
      mkdtemp.c qsort.c qsort_arg.c quotes.c
-     sprompt.c tar.c thread.c wait_error.c getopt.c getopt_long.c dirent.c
+     sprompt.c syswrap.c tar.c thread.c wait_error.c getopt.c getopt_long.c dirent.c
      win32env.c win32error.c win32setlocale.c);
 
    push(@pgportfiles, 'rint.c') if ($vsVersion < '12.00');