Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 5e1365a

Browse files
committed
Fix null-dereference crash in parse_xml_decl().
parse_xml_decl's header comment says you can pass NULL for any unwanted output parameter, but it failed to honor this contract for the "standalone" flag. The only currently-affected caller is xml_recv, so the net effect is that sending a binary XML value containing a standalone parameter in its xml declaration would crash the backend. Per bug #6044 from Christopher Dillard. In passing, remove useless initializations of parse_xml_decl's output parameters in xml_parse. Back-patch to 8.3, where this code was introduced.
1 parent 4c60a77 commit 5e1365a

File tree

1 file changed

+6
-4
lines changed
  • src/backend/utils/adt

1 file changed

+6
-4
lines changed

src/backend/utils/adt/xml.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,13 +1067,15 @@ parse_xml_decl(const xmlChar *str, size_t *lenp,
10671067
if (xmlStrncmp(p, (xmlChar *) "'yes'", 5) == 0 ||
10681068
xmlStrncmp(p, (xmlChar *) "\"yes\"", 5) == 0)
10691069
{
1070-
*standalone = 1;
1070+
if (standalone)
1071+
*standalone = 1;
10711072
p += 5;
10721073
}
10731074
else if (xmlStrncmp(p, (xmlChar *) "'no'", 4) == 0 ||
10741075
xmlStrncmp(p, (xmlChar *) "\"no\"", 4) == 0)
10751076
{
1076-
*standalone = 0;
1077+
if (standalone)
1078+
*standalone = 0;
10771079
p += 4;
10781080
}
10791081
else
@@ -1218,8 +1220,8 @@ xml_parse(text *data, XmlOptionType xmloption_arg, bool preserve_whitespace,
12181220
{
12191221
int res_code;
12201222
size_t count;
1221-
xmlChar *version = NULL;
1222-
int standalone = -1;
1223+
xmlChar *version;
1224+
int standalone;
12231225

12241226
res_code = parse_xml_decl(utf8string,
12251227
&count, &version, NULL, &standalone);

0 commit comments

Comments
 (0)