Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 44f1fc8

Browse files
committed
Fix out-of-memory handling in ecpglib.
ecpg_build_params() would crash on a null pointer dereference if realloc() failed, due to updating the persistent "stmt" struct too aggressively. (Even without the crash, this would've leaked the old storage that we were trying to realloc.) Per Coverity. This seems to have been broken in commit 0cc0507, so back-patch into v12.
1 parent 9c679a0 commit 44f1fc8

File tree

1 file changed

+24
-13
lines changed

1 file changed

+24
-13
lines changed

src/interfaces/ecpg/ecpglib/execute.c

+24-13
Original file line numberDiff line numberDiff line change
@@ -1499,26 +1499,37 @@ ecpg_build_params(struct statement *stmt)
14991499
}
15001500
else
15011501
{
1502-
if (!(stmt->paramvalues = (char **) ecpg_realloc(stmt->paramvalues, sizeof(char *) * (stmt->nparams + 1), stmt->lineno)))
1502+
bool realloc_failed = false;
1503+
char **newparamvalues;
1504+
int *newparamlengths;
1505+
int *newparamformats;
1506+
1507+
/* enlarge all the param arrays */
1508+
if ((newparamvalues = (char **) ecpg_realloc(stmt->paramvalues, sizeof(char *) * (stmt->nparams + 1), stmt->lineno)))
1509+
stmt->paramvalues = newparamvalues;
1510+
else
1511+
realloc_failed = true;
1512+
1513+
if ((newparamlengths = (int *) ecpg_realloc(stmt->paramlengths, sizeof(int) * (stmt->nparams + 1), stmt->lineno)))
1514+
stmt->paramlengths = newparamlengths;
1515+
else
1516+
realloc_failed = true;
1517+
1518+
if ((newparamformats = (int *) ecpg_realloc(stmt->paramformats, sizeof(int) * (stmt->nparams + 1), stmt->lineno)))
1519+
stmt->paramformats = newparamformats;
1520+
else
1521+
realloc_failed = true;
1522+
1523+
if (realloc_failed)
15031524
{
15041525
ecpg_free_params(stmt, false);
15051526
ecpg_free(tobeinserted);
15061527
return false;
15071528
}
1508-
stmt->paramvalues[stmt->nparams] = tobeinserted;
15091529

1510-
if (!(stmt->paramlengths = (int *) ecpg_realloc(stmt->paramlengths, sizeof(int) * (stmt->nparams + 1), stmt->lineno)))
1511-
{
1512-
ecpg_free_params(stmt, false);
1513-
return false;
1514-
}
1530+
/* only now can we assign ownership of "tobeinserted" to stmt */
1531+
stmt->paramvalues[stmt->nparams] = tobeinserted;
15151532
stmt->paramlengths[stmt->nparams] = binary_length;
1516-
1517-
if (!(stmt->paramformats = (int *) ecpg_realloc(stmt->paramformats, sizeof(int) * (stmt->nparams + 1), stmt->lineno)))
1518-
{
1519-
ecpg_free_params(stmt, false);
1520-
return false;
1521-
}
15221533
stmt->paramformats[stmt->nparams] = (binary_format ? 1 : 0);
15231534
stmt->nparams++;
15241535

0 commit comments

Comments
 (0)