Add error-throwing wrappers for the printf family of functions.

All known standard library implementations of these functions can fail
with ENOMEM.  A caller neglecting to check for failure would experience
missing output, information exposure, or a crash.  Check return values
within wrappers and code, currently just snprintf.c, that bypasses the
wrappers.  The wrappers do not return after an error, so their callers
need not check.  Back-patch to 9.0 (all supported versions).

Popular free software standard library implementations do take pains to
bypass malloc() in simple cases, but they risk ENOMEM for floating point
numbers, positional arguments, large field widths, and large precisions.
No specification demands such caution, so this commit regards every call
to a printf family function as a potential threat.

Injecting the wrappers implicitly is a compromise between patch scope
and design goals.  I would prefer to edit each call site to name a
wrapper explicitly.  libpq and the ECPG libraries would, ideally, convey
errors to the caller rather than abort().  All that would be painfully
invasive for a back-patched security fix, hence this compromise.

Security: CVE-2015-3166

diff --git a/src/include/port.h b/src/include/port.h
index 6bcb8ae7e81ee30920f8a7c4841ed776fb25674e..3692cdbbc5489cd5465ef056fe83074eec3737ae 100644 (file)
--- a/src/include/port.h
+++ b/src/include/port.h
@@ -148,12 +148,11 @@ extern int    pg_strncasecmp(const char *s1, const char *s2, size_t n);
 extern unsigned char pg_toupper(unsigned char ch);
 extern unsigned char pg_tolower(unsigned char ch);
 
-#ifdef USE_REPL_SNPRINTF
-
 /*
- * Versions of libintl >= 0.13 try to replace printf() and friends with
- * macros to their own versions that understand the %$ format.  We do the
- * same, so disable their macros, if they exist.
+ * Capture macro-compatible calls to printf() and friends, and redirect them
+ * to wrappers that throw errors in lieu of reporting failure in a return
+ * value.  Versions of libintl >= 0.13 similarly redirect to versions that
+ * understand the %$ format, so disable libintl macros first.
  */
 #ifdef vsnprintf
 #undef vsnprintf
@@ -177,6 +176,55 @@ extern unsigned char pg_tolower(unsigned char ch);
 #undef printf
 #endif
 
+extern int
+vsnprintf_throw_on_fail(char *str, size_t count, const char *fmt, va_list args)
+__attribute__((format(printf, 3, 0)));
+extern int
+snprintf_throw_on_fail(char *str, size_t count, const char *fmt,...)
+__attribute__((format(printf, 3, 4)));
+extern int
+vsprintf_throw_on_fail(char *str, const char *fmt, va_list args)
+__attribute__((format(printf, 2, 0)));
+extern int
+sprintf_throw_on_fail(char *str, const char *fmt,...)
+__attribute__((format(printf, 2, 3)));
+extern int
+vfprintf_throw_on_fail(FILE *stream, const char *fmt, va_list args)
+__attribute__((format(printf, 2, 0)));
+extern int
+fprintf_throw_on_fail(FILE *stream, const char *fmt,...)
+__attribute__((format(printf, 2, 3)));
+extern int
+printf_throw_on_fail(const char *fmt,...)
+__attribute__((format(printf, 1, 2)));
+
+/*
+ * The GCC-specific code below prevents the __attribute__(... 'printf')
+ * above from being replaced, and this is required because gcc doesn't
+ * know anything about printf_throw_on_fail.
+ */
+#ifdef __GNUC__
+#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__)
+#define snprintf(...)  snprintf_throw_on_fail(__VA_ARGS__)
+#define vsprintf(...)  vsprintf_throw_on_fail(__VA_ARGS__)
+#define sprintf(...)   sprintf_throw_on_fail(__VA_ARGS__)
+#define vfprintf(...)  vfprintf_throw_on_fail(__VA_ARGS__)
+#define fprintf(...)   fprintf_throw_on_fail(__VA_ARGS__)
+#define printf(...)        printf_throw_on_fail(__VA_ARGS__)
+#else
+#define vsnprintf      vsnprintf_throw_on_fail
+#define snprintf       snprintf_throw_on_fail
+#define vsprintf       vsprintf_throw_on_fail
+#define sprintf            sprintf_throw_on_fail
+#define vfprintf       vfprintf_throw_on_fail
+#define fprintf            fprintf_throw_on_fail
+#define printf         printf_throw_on_fail
+#endif
+
+#ifdef USE_REPL_SNPRINTF
+
+/* Code outside syswrap.c should not call these. */
+
 extern int pg_vsnprintf(char *str, size_t count, const char *fmt, va_list args);
 extern int
 pg_snprintf(char *str, size_t count, const char *fmt,...)
@@ -197,28 +245,6 @@ pg_printf(const char *fmt,...)
 /* This extension allows gcc to check the format string */
 __attribute__((format(printf, 1, 2)));
 
-/*
- * The GCC-specific code below prevents the __attribute__(... 'printf')
- * above from being replaced, and this is required because gcc doesn't
- * know anything about pg_printf.
- */
-#ifdef __GNUC__
-#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
-#define snprintf(...)  pg_snprintf(__VA_ARGS__)
-#define vsprintf(...)  pg_vsprintf(__VA_ARGS__)
-#define sprintf(...)   pg_sprintf(__VA_ARGS__)
-#define vfprintf(...)  pg_vfprintf(__VA_ARGS__)
-#define fprintf(...)   pg_fprintf(__VA_ARGS__)
-#define printf(...)        pg_printf(__VA_ARGS__)
-#else
-#define vsnprintf      pg_vsnprintf
-#define snprintf       pg_snprintf
-#define vsprintf       pg_vsprintf
-#define sprintf            pg_sprintf
-#define vfprintf       pg_vfprintf
-#define fprintf            pg_fprintf
-#define printf         pg_printf
-#endif
 #endif   /* USE_REPL_SNPRINTF */
 
 /*

diff --git a/src/interfaces/ecpg/compatlib/Makefile b/src/interfaces/ecpg/compatlib/Makefile
index 45c8f9462f4f9cb3c22259539b23db06a7df11ac..481059f4bc8509555772aa0a4ff0c84843e0f756 100644 (file)
--- a/src/interfaces/ecpg/compatlib/Makefile
+++ b/src/interfaces/ecpg/compatlib/Makefile
@@ -36,6 +36,7 @@ all: all-lib
 # Shared library stuff
 include $(top_srcdir)/src/Makefile.shlib
 
+# XXX This library uses no symbols from snprintf.c.
 snprintf.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 

diff --git a/src/interfaces/ecpg/ecpglib/.gitignore b/src/interfaces/ecpg/ecpglib/.gitignore
index e6c60b16fcd2c189ff4a2b516f511933a2e79aa7..f3513db90c1076029b72d08bdecc919616a7200a 100644 (file)
--- a/src/interfaces/ecpg/ecpglib/.gitignore
+++ b/src/interfaces/ecpg/ecpglib/.gitignore
@@ -6,4 +6,5 @@
 /path.c
 /pgstrcasecmp.c
 /strlcpy.c
+/syswrap.c
 /thread.c

diff --git a/src/interfaces/ecpg/ecpglib/Makefile b/src/interfaces/ecpg/ecpglib/Makefile
index 46693896bbbecc31acc5cd8dd4f56a1ebe584227..50e0b0650c69e5d7b8a662405ef727d71f2eb6ec 100644 (file)
--- a/src/interfaces/ecpg/ecpglib/Makefile
+++ b/src/interfaces/ecpg/ecpglib/Makefile
@@ -25,7 +25,7 @@ override CFLAGS += $(PTHREAD_CFLAGS)
 LIBS := $(filter-out -lpgport, $(LIBS))
 
 OBJS= execute.o typename.o descriptor.o sqlda.o data.o error.o prepare.o memory.o \
-   connect.o misc.o path.o pgstrcasecmp.o \
+   connect.o misc.o path.o pgstrcasecmp.o syswrap.o \
    $(filter snprintf.o strlcpy.o isinf.o, $(LIBOBJS))
 
 # thread.c is needed only for non-WIN32 implementation of path.c
@@ -58,7 +58,7 @@ include $(top_srcdir)/src/Makefile.shlib
 # necessarily use the same object files as the backend uses. Instead,
 # symlink the source files in here and build our own object file.
 
-path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c isinf.c: % : $(top_srcdir)/src/port/%
+path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c isinf.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 misc.o: misc.c $(top_builddir)/src/port/pg_config_paths.h
@@ -75,6 +75,6 @@ uninstall: uninstall-lib
 
 clean distclean: clean-lib
    rm -f $(OBJS)
-   rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c
+   rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c
 
 maintainer-clean: distclean maintainer-clean-lib

diff --git a/src/interfaces/ecpg/pgtypeslib/.gitignore b/src/interfaces/ecpg/pgtypeslib/.gitignore
index aa5bdb837f283f8002b88a26122f5c71e0dc3104..83f896c7a7a2283158b81ed7dde6a34521a8c43f 100644 (file)
--- a/src/interfaces/ecpg/pgtypeslib/.gitignore
+++ b/src/interfaces/ecpg/pgtypeslib/.gitignore
@@ -4,3 +4,4 @@
 /exports.list
 
 /pgstrcasecmp.c
+/syswrap.c

diff --git a/src/interfaces/ecpg/pgtypeslib/Makefile b/src/interfaces/ecpg/pgtypeslib/Makefile
index 7f71e1bc5cc8d1c2cc562a70f30cae2b7312d00c..69b8c8325089b5f66fb95b3abeb2f1eb7e096d5c 100644 (file)
--- a/src/interfaces/ecpg/pgtypeslib/Makefile
+++ b/src/interfaces/ecpg/pgtypeslib/Makefile
@@ -29,7 +29,7 @@ SHLIB_LINK += -lm
 SHLIB_EXPORTS = exports.txt
 
 OBJS= numeric.o datetime.o common.o dt_common.o timestamp.o interval.o \
-   pgstrcasecmp.o \
+   pgstrcasecmp.o syswrap.o \
    $(filter rint.o snprintf.o, $(LIBOBJS))
 
 all: all-lib
@@ -42,7 +42,7 @@ include $(top_srcdir)/src/Makefile.shlib
 # necessarily use the same object files as the backend uses. Instead,
 # symlink the source files in here and build our own object file.
 
-pgstrcasecmp.c rint.c snprintf.c: % : $(top_srcdir)/src/port/%
+pgstrcasecmp.c rint.c snprintf.c syswrap.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 install: all installdirs install-lib
@@ -52,6 +52,6 @@ installdirs: installdirs-lib
 uninstall: uninstall-lib
 
 clean distclean: clean-lib
-   rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c
+   rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c syswrap.c
 
 maintainer-clean: distclean maintainer-clean-lib

diff --git a/src/interfaces/libpq/.gitignore b/src/interfaces/libpq/.gitignore
index f086ec3db7ecc39babb2895a0a3571a61884fa2e..1be81ec6588a871ed5600c3c33c2c288062d1b19 100644 (file)
--- a/src/interfaces/libpq/.gitignore
+++ b/src/interfaces/libpq/.gitignore
@@ -8,6 +8,7 @@
 /snprintf.c
 /strerror.c
 /strlcpy.c
+/syswrap.c
 /thread.c
 /win32error.c
 /pgsleep.c

diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefile
index 98d9e8164f23487760b057fe4077175af4308fc5..74f10662bafd438e140c7c0f7e3ebb66a1182536 100644 (file)
--- a/src/interfaces/libpq/Makefile
+++ b/src/interfaces/libpq/Makefile
@@ -33,7 +33,7 @@ LIBS := $(LIBS:-lpgport=)
 OBJS=  fe-auth.o fe-connect.o fe-exec.o fe-misc.o fe-print.o fe-lobj.o \
    fe-protocol2.o fe-protocol3.o pqexpbuffer.o pqsignal.o fe-secure.o \
    libpq-events.o \
-   md5.o ip.o wchar.o encnames.o noblock.o pgstrcasecmp.o thread.o \
+   md5.o ip.o wchar.o encnames.o noblock.o pgstrcasecmp.o syswrap.o thread.o \
    $(filter crypt.o getaddrinfo.o inet_aton.o open.o snprintf.o strerror.o strlcpy.o win32error.o, $(LIBOBJS))
 
 ifeq ($(PORTNAME), cygwin)
@@ -80,7 +80,7 @@ backend_src = $(top_srcdir)/src/backend
 # For port modules, this only happens if configure decides the module
 # is needed (see filter hack in OBJS, above).
 
-crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
+crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c syswrap.c thread.c win32error.c pgsleep.c: % : $(top_srcdir)/src/port/%
    rm -f $@ && $(LN_S) $< .
 
 md5.c ip.c: % : $(backend_src)/libpq/%
@@ -133,7 +133,7 @@ ifneq (,$(findstring $(PORTNAME), win32 cygwin))
 endif
 
 clean distclean: clean-lib
-   rm -f $(OBJS) pg_config_paths.h crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
+   rm -f $(OBJS) pg_config_paths.h crypt.c getaddrinfo.c inet_aton.c noblock.c open.c pgstrcasecmp.c snprintf.c strerror.c strlcpy.c syswrap.c thread.c md5.c ip.c encnames.c wchar.c win32error.c pgsleep.c pthread.h libpq.rc
 # Might be left over from a Win32 client-only build
    rm -f pg_config_paths.h
 

diff --git a/src/interfaces/libpq/bcc32.mak b/src/interfaces/libpq/bcc32.mak
index f109f27a365b44c0a2e2528c84dcce0ff4aa033f..4152ff855334c65e3eaec789c573f6cff9454914 100644 (file)
--- a/src/interfaces/libpq/bcc32.mak
+++ b/src/interfaces/libpq/bcc32.mak
@@ -104,6 +104,7 @@ CLEAN :
    -@erase "$(INTDIR)\dirmod.obj"
    -@erase "$(INTDIR)\pgsleep.obj"
    -@erase "$(INTDIR)\open.obj"
+   -@erase "$(INTDIR)\syswrap.obj"
    -@erase "$(INTDIR)\win32error.obj"
    -@erase "$(OUTDIR)\$(OUTFILENAME).lib"
    -@erase "$(OUTDIR)\$(OUTFILENAME)dll.lib"
@@ -145,6 +146,7 @@ LIB32_OBJS= \
    "$(INTDIR)\dirmod.obj" \
    "$(INTDIR)\pgsleep.obj" \
    "$(INTDIR)\open.obj" \
+   "$(INTDIR)\syswrap.obj" \
    "$(INTDIR)\win32error.obj" \
    "$(INTDIR)\pthread-win32.obj"
 
@@ -273,6 +275,11 @@ LINK32_FLAGS = -Gn -L$(BCB)\lib;$(INTDIR); -x -Tpd -v
    $(CPP_PROJ) /I"." ..\..\port\open.c
 <<
 
+"$(INTDIR)\syswrap.obj" : ..\..\port\syswrap.c
+   $(CPP) @<<
+   $(CPP_PROJ) ..\..\port\syswrap.c
+<<
+
 "$(INTDIR)\win32error.obj" : ..\..\port\win32error.c
    $(CPP) @<<
    $(CPP_PROJ) /I"." ..\..\port\win32error.c

diff --git a/src/interfaces/libpq/win32.mak b/src/interfaces/libpq/win32.mak
index 56b24a5cdcef7e741be312a58e757c5f54517b03..e075051f042b519c3b829488b079de498a6ce6a0 100644 (file)
--- a/src/interfaces/libpq/win32.mak
+++ b/src/interfaces/libpq/win32.mak
@@ -111,6 +111,7 @@ CLEAN :
    -@erase "$(INTDIR)\dirmod.obj"
    -@erase "$(INTDIR)\pgsleep.obj"
    -@erase "$(INTDIR)\open.obj"
+   -@erase "$(INTDIR)\syswrap.obj"
    -@erase "$(INTDIR)\win32error.obj"
    -@erase "$(OUTDIR)\$(OUTFILENAME).lib"
    -@erase "$(OUTDIR)\$(OUTFILENAME)dll.lib"
@@ -154,6 +155,7 @@ LIB32_OBJS= \
    "$(INTDIR)\dirmod.obj" \
    "$(INTDIR)\pgsleep.obj" \
    "$(INTDIR)\open.obj" \
+   "$(INTDIR)\syswrap.obj" \
    "$(INTDIR)\win32error.obj" \
    "$(INTDIR)\pthread-win32.obj"
 
@@ -311,6 +313,11 @@ LINK32_OBJS= \
    $(CPP_PROJ) /I"." ..\..\port\open.c
 <<
 
+"$(INTDIR)\syswrap.obj" : ..\..\port\syswrap.c
+   $(CPP) @<<
+   $(CPP_PROJ) ..\..\port\syswrap.c
+<<
+
 "$(INTDIR)\win32error.obj" : ..\..\port\win32error.c
    $(CPP) @<<
    $(CPP_PROJ) /I"." ..\..\port\win32error.c

diff --git a/src/port/Makefile b/src/port/Makefile
index 8589108f55c10586106d85070f9fe58de1a8e324..c7000ba9a615129ce7e0c23f765b2e381cb8957c 100644 (file)
--- a/src/port/Makefile
+++ b/src/port/Makefile
@@ -31,7 +31,7 @@ override CPPFLAGS := -I$(top_builddir)/src/port -DFRONTEND $(CPPFLAGS)
 LIBS += $(PTHREAD_LIBS)
 
 OBJS = $(LIBOBJS) chklocale.o dirmod.o exec.o noblock.o path.o \
-   pgsleep.o pgstrcasecmp.o qsort.o qsort_arg.o sprompt.o thread.o
+   pgsleep.o pgstrcasecmp.o qsort.o qsort_arg.o sprompt.o syswrap.o thread.o
 ifneq (,$(filter $(PORTNAME),cygwin win32))
 OBJS += pipe.o
 endif

diff --git a/src/port/snprintf.c b/src/port/snprintf.c
index 1fd91a36e8fe0acf25f681b0bf5b7674ee9f54b6..281bba169e65d1fa305d39660e2af1b1a9342752 100644 (file)
--- a/src/port/snprintf.c
+++ b/src/port/snprintf.c
@@ -114,6 +114,7 @@ typedef struct
    /* bufend == NULL is for sprintf, where we assume buf is big enough */
    FILE       *stream;         /* eventual output destination, or NULL */
    int         nchars;         /* # chars already sent to stream */
+   bool        failed;         /* call is a failure; errno is set */
 }  PrintfTarget;
 
 /*
@@ -143,7 +144,7 @@ typedef union
 
 
 static void flushbuffer(PrintfTarget * target);
-static int dopr(PrintfTarget * target, const char *format, va_list args);
+static void dopr(PrintfTarget * target, const char *format, va_list args);
 
 
 int
@@ -157,14 +158,10 @@ pg_vsnprintf(char *str, size_t count, const char *fmt, va_list args)
    target.bufend = str + count - 1;
    target.stream = NULL;
    /* target.nchars is unused in this case */
-   if (dopr(&target, fmt, args))
-   {
-       *(target.bufptr) = '\0';
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    *(target.bufptr) = '\0';
-   return target.bufptr - target.bufstart;
+   return target.failed ? -1 : (target.bufptr - target.bufstart);
 }
 
 int
@@ -190,14 +187,10 @@ pg_vsprintf(char *str, const char *fmt, va_list args)
    target.bufend = NULL;
    target.stream = NULL;
    /* target.nchars is unused in this case */
-   if (dopr(&target, fmt, args))
-   {
-       *(target.bufptr) = '\0';
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    *(target.bufptr) = '\0';
-   return target.bufptr - target.bufstart;
+   return target.failed ? -1 : (target.bufptr - target.bufstart);
 }
 
 int
@@ -227,14 +220,11 @@ pg_vfprintf(FILE *stream, const char *fmt, va_list args)
    target.bufend = buffer + sizeof(buffer) - 1;
    target.stream = stream;
    target.nchars = 0;
-   if (dopr(&target, fmt, args))
-   {
-       errno = EINVAL;         /* bad format */
-       return -1;
-   }
+   target.failed = false;
+   dopr(&target, fmt, args);
    /* dump any remaining buffer contents */
    flushbuffer(&target);
-   return target.nchars;
+   return target.failed ? -1 : target.nchars;
 }
 
 int
@@ -261,14 +251,24 @@ pg_printf(const char *fmt,...)
    return len;
 }
 
-/* call this only when stream is defined */
+/*
+ * Attempt to write the entire buffer to target->stream; discard the entire
+ * buffer in any case.  Call this only when target->stream is defined.
+ */
 static void
 flushbuffer(PrintfTarget * target)
 {
    size_t      nc = target->bufptr - target->bufstart;
 
-   if (nc > 0)
-       target->nchars += fwrite(target->bufstart, 1, nc, target->stream);
+   if (!target->failed && nc > 0)
+   {
+       size_t      written;
+
+       written = fwrite(target->bufstart, 1, nc, target->stream);
+       target->nchars += written;
+       if (written != nc)
+           target->failed = true;
+   }
    target->bufptr = target->bufstart;
 }
 
@@ -295,7 +295,7 @@ static void trailing_pad(int *padlen, PrintfTarget * target);
 /*
  * dopr(): poor man's version of doprintf
  */
-static int
+static void
 dopr(PrintfTarget * target, const char *format, va_list args)
 {
    const char *format_start = format;
@@ -372,12 +372,12 @@ nextch1:
            case '$':
                have_dollar = true;
                if (accum <= 0 || accum > NL_ARGMAX)
-                   return -1;
+                   goto bad_format;
                if (afterstar)
                {
                    if (argtypes[accum] &&
                        argtypes[accum] != ATYPE_INT)
-                       return -1;
+                       goto bad_format;
                    argtypes[accum] = ATYPE_INT;
                    last_dollar = Max(last_dollar, accum);
                    afterstar = false;
@@ -414,7 +414,7 @@ nextch1:
                        atype = ATYPE_INT;
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != atype)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = atype;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -426,7 +426,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_INT)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_INT;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -439,7 +439,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_CHARPTR)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_CHARPTR;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -455,7 +455,7 @@ nextch1:
                {
                    if (argtypes[fmtpos] &&
                        argtypes[fmtpos] != ATYPE_DOUBLE)
-                       return -1;
+                       goto bad_format;
                    argtypes[fmtpos] = ATYPE_DOUBLE;
                    last_dollar = Max(last_dollar, fmtpos);
                }
@@ -476,7 +476,7 @@ nextch1:
 
    /* Per spec, you use either all dollar or all not. */
    if (have_dollar && have_non_dollar)
-       return -1;
+       goto bad_format;
 
    /*
     * In dollar mode, collect the arguments in physical order.
@@ -486,7 +486,7 @@ nextch1:
        switch (argtypes[i])
        {
            case ATYPE_NONE:
-               return -1;      /* invalid format */
+               goto bad_format;
            case ATYPE_INT:
                argvalues[i].i = va_arg(args, int);
                break;
@@ -511,6 +511,9 @@ nextch1:
    format = format_start;
    while ((ch = *format++) != '\0')
    {
+       if (target->failed)
+           break;
+
        if (ch != '%')
        {
            dopr_outch(ch, target);
@@ -755,7 +758,11 @@ nextch2:
        }
    }
 
-   return 0;
+   return;
+
+bad_format:
+   errno = EINVAL;
+   target->failed = true;
 }
 
 static size_t
@@ -805,8 +812,10 @@ fmtptr(void *value, PrintfTarget * target)
 
    /* we rely on regular C library's sprintf to do the basic conversion */
    vallen = sprintf(convert, "%p", value);
-
-   dostr(convert, vallen, target);
+   if (vallen < 0)
+       target->failed = true;
+   else
+       dostr(convert, vallen, target);
 }
 
 static void
@@ -939,16 +948,19 @@ fmtfloat(double value, char type, int forcesign, int leftjust,
 
    if (pointflag)
    {
-       sprintf(fmt, "%%.%d%c", prec, type);
+       if (sprintf(fmt, "%%.%d%c", prec, type) < 0)
+           goto fail;
        zeropadlen = precision - prec;
    }
-   else
-       sprintf(fmt, "%%%c", type);
+   else if (sprintf(fmt, "%%%c", type) < 0)
+       goto fail;
 
    if (!isnan(value) && adjust_sign((value < 0), forcesign, &signvalue))
        value = -value;
 
    vallen = sprintf(convert, fmt, value);
+   if (vallen < 0)
+       goto fail;
 
    /* If it's infinity or NaN, forget about doing any zero-padding */
    if (zeropadlen > 0 && !isdigit((unsigned char) convert[vallen - 1]))
@@ -988,6 +1000,10 @@ fmtfloat(double value, char type, int forcesign, int leftjust,
    }
 
    trailing_pad(&padlen, target);
+   return;
+
+fail:
+   target->failed = true;
 }
 
 static void

diff --git a/src/port/syswrap.c b/src/port/syswrap.c
new file mode 100644 (file)
index 0000000..8415a33
--- /dev/null
+++ b/src/port/syswrap.c
@@ -0,0 +1,155 @@
+/*-------------------------------------------------------------------------
+ *
+ * syswrap.c
+ *   error-throwing wrappers around POSIX functions that rarely fail
+ *
+ * Portions Copyright (c) 1996-2015, PostgreSQL Global Development Group
+ *
+ *
+ * IDENTIFICATION
+ *   src/port/syswrap.c
+ *
+ *-------------------------------------------------------------------------
+ */
+
+#ifndef FRONTEND
+#include "postgres.h"
+#else
+#include "postgres_fe.h"
+#endif
+
+/* Prevent recursion */
+#undef vsnprintf
+#undef snprintf
+#undef vsprintf
+#undef sprintf
+#undef vfprintf
+#undef fprintf
+#undef printf
+
+/* When the libc primitives are lacking, use our own. */
+#ifdef USE_REPL_SNPRINTF
+#ifdef __GNUC__
+#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
+#define snprintf(...)  pg_snprintf(__VA_ARGS__)
+#define vsprintf(...)  pg_vsprintf(__VA_ARGS__)
+#define sprintf(...)   pg_sprintf(__VA_ARGS__)
+#define vfprintf(...)  pg_vfprintf(__VA_ARGS__)
+#define fprintf(...)   pg_fprintf(__VA_ARGS__)
+#define printf(...)        pg_printf(__VA_ARGS__)
+#else
+#define vsnprintf      pg_vsnprintf
+#define snprintf       pg_snprintf
+#define vsprintf       pg_vsprintf
+#define sprintf            pg_sprintf
+#define vfprintf       pg_vfprintf
+#define fprintf            pg_fprintf
+#define printf         pg_printf
+#endif
+#endif   /* USE_REPL_SNPRINTF */
+
+/*
+ * We abort() in the frontend, rather than exit(), because libpq in particular
+ * has no business calling exit().  These failures had better be rare.
+ */
+#ifdef FRONTEND
+#define LIB_ERR(func) \
+do { \
+   int discard = fprintf(stderr, "%s failed: %s\n", func, strerror(errno)); \
+   (void) discard; \
+   abort(); \
+} while (0)
+#else
+#define LIB_ERR(func) elog(ERROR, "%s failed: %m", func)
+#endif
+
+int
+vsnprintf_throw_on_fail(char *str, size_t count, const char *fmt, va_list args)
+{
+   int         save_errno;
+   int         ret;
+
+   /*
+    * On HP-UX B.11.31, a call that truncates output returns -1 without
+    * setting errno.  (SUSv2 allowed this until the approval of Base Working
+    * Group Resolution BWG98-006.)  We could avoid the save and restore of
+    * errno on most platforms.
+    */
+   save_errno = errno;
+   errno = 0;
+   ret = vsnprintf(str, count, fmt, args);
+   if (ret < 0 && errno != 0)
+       LIB_ERR("vsnprintf");
+   errno = save_errno;
+   return ret;
+}
+
+int
+snprintf_throw_on_fail(char *str, size_t count, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vsnprintf_throw_on_fail(str, count, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+vsprintf_throw_on_fail(char *str, const char *fmt, va_list args)
+{
+   int         ret;
+
+   ret = vsprintf(str, fmt, args);
+   if (ret < 0)
+       LIB_ERR("vsprintf");
+   return ret;
+}
+
+int
+sprintf_throw_on_fail(char *str, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vsprintf_throw_on_fail(str, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+vfprintf_throw_on_fail(FILE *stream, const char *fmt, va_list args)
+{
+   int         ret;
+
+   ret = vfprintf(stream, fmt, args);
+   if (ret < 0)
+       LIB_ERR("vfprintf");
+   return ret;
+}
+
+int
+fprintf_throw_on_fail(FILE *stream, const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vfprintf_throw_on_fail(stream, fmt, args);
+   va_end(args);
+   return ret;
+}
+
+int
+printf_throw_on_fail(const char *fmt,...)
+{
+   int         ret;
+   va_list     args;
+
+   va_start(args, fmt);
+   ret = vfprintf_throw_on_fail(stdout, fmt, args);
+   va_end(args);
+   return ret;
+}

diff --git a/src/tools/msvc/Mkvcbuild.pm b/src/tools/msvc/Mkvcbuild.pm
index fa97c79471de48b0913f98c0b546a8192e0fb1bd..d1bbedc8bc20b907f12fbbafd09a4944d3ef6de7 100644 (file)
--- a/src/tools/msvc/Mkvcbuild.pm
+++ b/src/tools/msvc/Mkvcbuild.pm
@@ -52,7 +52,7 @@ sub mkvcbuild
       chklocale.c crypt.c fseeko.c getrusage.c inet_aton.c random.c srandom.c
       getaddrinfo.c gettimeofday.c kill.c open.c erand48.c mkdtemp.c
       snprintf.c strlcat.c strlcpy.c dirmod.c exec.c noblock.c path.c pipe.c
-      pgsleep.c pgstrcasecmp.c qsort.c qsort_arg.c sprompt.c thread.c
+      pgsleep.c pgstrcasecmp.c qsort.c qsort_arg.c sprompt.c syswrap.c thread.c
       getopt.c getopt_long.c dirent.c rint.c win32env.c win32error.c);
 
     $libpgport = $solution->AddProject('libpgport','lib','misc');