Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit ef0eecf

Browse files
committed
This simple patch to catalog/pg_type.c fixes a buffer overrun. It
was detected by Electric Fence and triggered by statements like: SELECT * into table t from pg_database; The system would crash on a memmove call in DataFile() with arguments like this: memmove(0x0, 0x0, 0); Maurice Gittens
1 parent dbf34c5 commit ef0eecf

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/backend/catalog/pg_type.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
*
88
*
99
* IDENTIFICATION
10-
* $Header: /cvsroot/pgsql/src/backend/catalog/pg_type.c,v 1.20 1998/02/26 04:30:45 momjian Exp $
10+
* $Header: /cvsroot/pgsql/src/backend/catalog/pg_type.c,v 1.21 1998/03/30 17:46:45 momjian Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -318,6 +318,7 @@ TypeCreate(char *typeName,
318318
TupleDesc tupDesc;
319319

320320
Oid argList[8];
321+
NameData name;
321322

322323

323324
static ScanKeyData typeKey[1] = {
@@ -387,7 +388,8 @@ TypeCreate(char *typeName,
387388
* ----------------
388389
*/
389390
i = 0;
390-
values[i++] = PointerGetDatum(typeName); /* 1 */
391+
namestrcpy(&name,typeName);
392+
values[i++] = NameGetDatum(&name); /* 1 */
391393
values[i++] = (Datum) GetUserId(); /* 2 */
392394
values[i++] = (Datum) internalSize; /* 3 */
393395
values[i++] = (Datum) externalSize; /* 4 */

0 commit comments

Comments
 (0)