mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-04 14:37:22 +02:00
Fix unsafe use of strtol() on a non-null-terminated Text datum.
jsonb_set() could produce wrong answers or incorrect error reports, or in
the worst case even crash, when trying to convert a path-array element into
an integer for use as an array subscript. Per report from Vitaly Burovoy.
Back-patch to 9.5 where the faulty code was introduced (in commit
c6947010ce
).
Michael Paquier
This commit is contained in:
parent
147112d098
commit
5f95521b3a
@ -3873,7 +3873,7 @@ setPathArray(JsonbIterator **it, Datum *path_elems, bool *path_nulls,
|
|||||||
/* pick correct index */
|
/* pick correct index */
|
||||||
if (level < path_len && !path_nulls[level])
|
if (level < path_len && !path_nulls[level])
|
||||||
{
|
{
|
||||||
char *c = VARDATA_ANY(path_elems[level]);
|
char *c = TextDatumGetCString(path_elems[level]);
|
||||||
long lindex;
|
long lindex;
|
||||||
|
|
||||||
errno = 0;
|
errno = 0;
|
||||||
|
Loading…
Reference in New Issue
Block a user