Skip to content

Commit 5f74d49

Browse files
tglsfdctglsfdc
committed
Defend against function calls with more than 8 arguments (code
used to overrun its fixed-size arrays before detecting error; not cool). Also, replace uses of magic constant '8' with 'MAXFARGS'.
1 parent 4c65382 commit 5f74d49

File tree

4 files changed

+33
-23
lines changed

4 files changed

+33
-23
lines changed

‎src/backend/parser/parse_coerce.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
*
88
*
99
* IDENTIFICATION
10-
* $Header: /cvsroot/pgsql/src/backend/parser/parse_coerce.c,v 2.17 1999/05/29 03:17:19 tgl Exp $
10+
* $Header: /cvsroot/pgsql/src/backend/parser/parse_coerce.c,v 2.18 1999/06/17 22:21:41 tgl Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -20,6 +20,7 @@
2020
#include "parser/parse_expr.h"
2121

2222
#include "catalog/pg_type.h"
23+
#include "parser/parse_func.h"
2324
#include "parser/parse_type.h"
2425
#include "parser/parse_target.h"
2526
#include "parser/parse_coerce.h"
@@ -132,7 +133,7 @@ can_coerce_type(int nargs, Oid *input_typeids, Oid *func_typeids)
132133
HeapTuple ftup;
133134
int i;
134135
Type tp;
135-
Oid oid_array[8];
136+
Oid oid_array[MAXFARGS];
136137

137138
/* run through argument list... */
138139
for (i = 0; i < nargs; i++)
@@ -160,7 +161,7 @@ can_coerce_type(int nargs, Oid *input_typeids, Oid *func_typeids)
160161
*/
161162
else if (input_typeids[i] != UNKNOWNOID)
162163
{
163-
MemSet(&oid_array[0], 0, 8 * sizeof(Oid));
164+
MemSet(oid_array, 0, MAXFARGS * sizeof(Oid));
164165
oid_array[0] = input_typeids[i];
165166

166167
/*

‎src/backend/parser/parse_func.c

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
*
88
*
99
* IDENTIFICATION
10-
* $Header: /cvsroot/pgsql/src/backend/parser/parse_func.c,v 1.46 1999/05/25 16:10:17 momjian Exp $
10+
* $Header: /cvsroot/pgsql/src/backend/parser/parse_func.c,v 1.47 1999/06/17 22:21:40 tgl Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -83,8 +83,6 @@ static Oid agg_select_candidate(Oid typeid, CandidateList candidates);
8383

8484
#define ISCOMPLEX(type) (typeidTypeRelid(type) ? true : false)
8585

86-
#define MAXFARGS 8 /* max # args to a c or postquel function */
87-
8886
typedef struct _SuperQE
8987
{
9088
Oid sqe_relid;
@@ -241,9 +239,9 @@ Node *
241239
ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
242240
int *curr_resno, int precedence)
243241
{
244-
Oid rettype = (Oid) 0;
245-
Oid argrelid = (Oid) 0;
246-
Oid funcid = (Oid) 0;
242+
Oid rettype = InvalidOid;
243+
Oid argrelid = InvalidOid;
244+
Oid funcid = InvalidOid;
247245
List *i = NIL;
248246
Node *first_arg = NULL;
249247
char *relname = NULL;
@@ -252,12 +250,12 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
252250
Oid relid;
253251
int nargs;
254252
Func *funcnode;
255-
Oid oid_array[8];
253+
Oid oid_array[MAXFARGS];
256254
Oid *true_oid_array;
257255
Node *retval;
258256
bool retset;
259257
bool attisset = false;
260-
Oid toid = (Oid) 0;
258+
Oid toid = InvalidOid;
261259
Expr *expr;
262260

263261
if (fargs)
@@ -425,7 +423,7 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
425423
* transform relation name arguments into varnodes of the appropriate
426424
* form.
427425
*/
428-
MemSet(&oid_array[0], 0, 8 * sizeof(Oid));
426+
MemSet(oid_array, 0, MAXFARGS * sizeof(Oid));
429427

430428
nargs = 0;
431429
foreach(i, fargs)
@@ -477,6 +475,14 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
477475
toid = exprType(pair);
478476
}
479477

478+
/* Most of the rest of the parser just assumes that functions do not
479+
* have more than MAXFARGS parameters. We have to test here to protect
480+
* against array overruns, etc.
481+
*/
482+
if (nargs >= MAXFARGS)
483+
elog(ERROR, "Cannot pass more than %d arguments to a function",
484+
MAXFARGS);
485+
480486
oid_array[nargs++] = toid;
481487
}
482488

@@ -638,7 +644,7 @@ static Oid
638644
funcid_get_rettype(Oid funcid)
639645
{
640646
HeapTuple func_tuple = NULL;
641-
Oid funcrettype = (Oid) 0;
647+
Oid funcrettype = InvalidOid;
642648

643649
func_tuple = SearchSysCacheTuple(PROOID,
644650
ObjectIdGetDatum(funcid),
@@ -701,8 +707,8 @@ func_get_candidates(char *funcname, int nargs)
701707
current_candidate = (CandidateList)
702708
palloc(sizeof(struct _CandidateList));
703709
current_candidate->args = (Oid *)
704-
palloc(8 * sizeof(Oid));
705-
MemSet(current_candidate->args, 0, 8 * sizeof(Oid));
710+
palloc(MAXFARGS * sizeof(Oid));
711+
MemSet(current_candidate->args, 0, MAXFARGS * sizeof(Oid));
706712
for (i = 0; i < nargs; i++)
707713
current_candidate->args[i] = pgProcP->proargtypes[i];
708714

@@ -1337,7 +1343,7 @@ setup_tlist(char *attname, Oid relid)
13371343
type_mod,
13381344
get_attname(relid, attno),
13391345
0,
1340-
(Oid) 0,
1346+
InvalidOid,
13411347
false);
13421348
varnode = makeVar(-1, attno, typeid, type_mod, 0, -1, attno);
13431349

@@ -1362,7 +1368,7 @@ setup_base_tlist(Oid typeid)
13621368
-1,
13631369
"<noname>",
13641370
0,
1365-
(Oid) 0,
1371+
InvalidOid,
13661372
false);
13671373
varnode = makeVar(-1, 1, typeid, -1, 0, -1, 1);
13681374
tle = makeTargetEntry(resnode, (Node *) varnode);

‎src/backend/parser/parse_target.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
*
88
*
99
* IDENTIFICATION
10-
* $Header: /cvsroot/pgsql/src/backend/parser/parse_target.c,v 1.41 1999/05/29 03:17:20 tgl Exp $
10+
* $Header: /cvsroot/pgsql/src/backend/parser/parse_target.c,v 1.42 1999/06/17 22:21:41 tgl Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -712,15 +712,15 @@ SizeTargetExpr(ParseState *pstate,
712712
int i;
713713
HeapTuple ftup;
714714
char *funcname;
715-
Oid oid_array[8];
715+
Oid oid_array[MAXFARGS];
716716

717717
FuncCall *func;
718718
A_Const *cons;
719719

720720
funcname = typeidTypeName(attrtype);
721721
oid_array[0] = attrtype;
722722
oid_array[1] = INT4OID;
723-
for (i = 2; i < 8; i++)
723+
for (i = 2; i < MAXFARGS; i++)
724724
oid_array[i] = InvalidOid;
725725

726726
/* attempt to find with arguments exactly as specified... */

‎src/include/parser/parse_func.h

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
*
77
* Copyright (c) 1994, Regents of the University of California
88
*
9-
* $Id: parse_func.h,v 1.15 1999/05/25 16:14:27 momjian Exp $
9+
* $Id: parse_func.h,v 1.16 1999/06/17 22:21:40 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -20,6 +20,9 @@
2020
#include <parser/parse_func.h>
2121
#include <parser/parse_node.h>
2222

23+
24+
#define MAXFARGS 8 /* max # args to a c or postquel function */
25+
2326
/*
2427
* This structure is used to explore the inheritance hierarchy above
2528
* nodes in the type tree in order to disambiguate among polymorphic
@@ -47,7 +50,7 @@ extern Node *ParseNestedFuncOrColumn(ParseState *pstate, Attr *attr,
4750
extern Node *ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
4851
int *curr_resno, int precedence);
4952

50-
extern void
51-
func_error(char *caller, char *funcname, int nargs, Oid *argtypes, char *msg);
53+
extern void func_error(char *caller, char *funcname,
54+
int nargs, Oid *argtypes, char *msg);
5255

5356
#endif /* PARSE_FUNC_H */

0 commit comments

Comments
 (0)