Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 13bba02

Browse files
committed
Avoid calling memcpy() with a NULL source pointer and count == 0.
As in commit 0a52d37, avoid doing something that has undefined results according to the C standard, even though in practice there does not seem to be any problem with it. This fixes two places in numeric.c that demonstrably could call memcpy() with such arguments. I looked through that file and didn't see any other places with similar hazards; this is not to claim that there are not such places in other files. Per report from Piotr Stefaniak. Back-patch to 9.5 which is where the previous commit was added. We're more or less setting a precedent that we will not worry about this type of issue in pre-9.5 branches unless someone demonstrates a problem in the field.
1 parent cb3384a commit 13bba02

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

src/backend/utils/adt/numeric.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -4769,7 +4769,9 @@ set_var_from_var(NumericVar *value, NumericVar *dest)
47694769

47704770
newbuf = digitbuf_alloc(value->ndigits + 1);
47714771
newbuf[0] = 0; /* spare digit for rounding */
4772-
memcpy(newbuf + 1, value->digits, value->ndigits * sizeof(NumericDigit));
4772+
if (value->ndigits > 0) /* else value->digits might be null */
4773+
memcpy(newbuf + 1, value->digits,
4774+
value->ndigits * sizeof(NumericDigit));
47734775

47744776
digitbuf_free(dest->buf);
47754777

@@ -5090,8 +5092,9 @@ make_result(NumericVar *var)
50905092
result->choice.n_long.n_weight = weight;
50915093
}
50925094

5093-
memcpy(NUMERIC_DIGITS(result), digits, n * sizeof(NumericDigit));
50945095
Assert(NUMERIC_NDIGITS(result) == n);
5096+
if (n > 0)
5097+
memcpy(NUMERIC_DIGITS(result), digits, n * sizeof(NumericDigit));
50955098

50965099
/* Check for overflow of int16 fields */
50975100
if (NUMERIC_WEIGHT(result) != weight ||

0 commit comments

Comments
 (0)