Modify wchar conversion routines to not fetch the next byte past the end

of a counted input string.  Marinos Yannikos' recent crash report turns
out to be due to applying pg_ascii2wchar_with_len to a TEXT object that
is smack up against the end of memory.  This is the second just-barely-
reproducible bug report I have seen that traces to some bit of code
fetching one more byte than it is allowed to.  Let's be more careful
out there, boys and girls.
While at it, I changed the code to not risk a similar crash when there
is a truncated multibyte character at the end of an input string.  The
output in this case might not be the most reasonable output possible;
if anyone wants to improve it further, step right up...

diff --git a/src/backend/utils/mb/mbutils.c b/src/backend/utils/mb/mbutils.c
index 0d3d8cb69bd175c5e4e47565ffbc92751beafb71..2abae59d62ba557a906450a707482a5d2e200d77 100644 (file)
--- a/src/backend/utils/mb/mbutils.c
+++ b/src/backend/utils/mb/mbutils.c
@@ -3,7 +3,7 @@
  * client encoding and server internal encoding.
  * (currently mule internal code (mic) is used)
  * Tatsuo Ishii
- * $Id: mbutils.c,v 1.15 2001/02/10 02:31:27 tgl Exp $
+ * $Id: mbutils.c,v 1.16 2001/03/08 00:24:34 tgl Exp $
  */
 #include "postgres.h"
 
@@ -230,7 +230,7 @@ pg_mbstrlen_with_len(const unsigned char *mbstr, int limit)
        int                     len = 0;
        int                     l;
 
-       while (*mbstr && limit > 0)
+       while (limit > 0 && *mbstr)
        {
                l = pg_mblen(mbstr);
                limit -= l;
@@ -252,7 +252,7 @@ pg_mbcliplen(const unsigned char *mbstr, int len, int limit)
        int                     clen = 0;
        int                     l;
 
-       while (*mbstr && len > 0)
+       while (len > 0 && *mbstr)
        {
                l = pg_mblen(mbstr);
                if ((clen + l) > limit)
@@ -267,7 +267,7 @@ pg_mbcliplen(const unsigned char *mbstr, int len, int limit)
 }
 
 /*
- * fuctions for utils/init
+ * functions for utils/init
  */
 static int     DatabaseEncoding = MULTIBYTE;
 

diff --git a/src/backend/utils/mb/wchar.c b/src/backend/utils/mb/wchar.c
index a4bf1131ad2e14a3550f441b46b63ac6ad855046..6d10cad020a35aee49f408d5a288d37a3f8a3a90 100644 (file)
--- a/src/backend/utils/mb/wchar.c
+++ b/src/backend/utils/mb/wchar.c
@@ -1,7 +1,7 @@
 /*
  * conversion functions between pg_wchar and multi-byte streams.
  * Tatsuo Ishii
- * $Id: wchar.c,v 1.15 2001/02/11 01:59:22 ishii Exp $
+ * $Id: wchar.c,v 1.16 2001/03/08 00:24:34 tgl Exp $
  *
  * WIN1250 client encoding updated by Pavel Behal
  *
@@ -27,7 +27,7 @@ static int pg_ascii2wchar_with_len
 {
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
                *to++ = *from++;
                len--;
@@ -52,23 +52,22 @@ static int pg_euc2wchar_with_len
 {
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
-               if (*from == SS2)
+               if (*from == SS2 && len >= 2)
                {
                        from++;
-                       len--;
                        *to = 0xff & *from++;
-                       len--;
+                       len -= 2;
                }
-               else if (*from == SS3)
+               else if (*from == SS3 && len >= 3)
                {
                        from++;
                        *to = *from++ << 8;
                        *to |= 0x3f & *from++;
                        len -= 3;
                }
-               else if (*from & 0x80)
+               else if ((*from & 0x80) && len >= 2)
                {
                        *to = *from++ << 8;
                        *to |= *from++;
@@ -140,24 +139,23 @@ static int pg_euccn2wchar_with_len
 {
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
-               if (*from == SS2)
+               if (*from == SS2 && len >= 3)
                {
                        from++;
-                       len--;
                        *to = 0x3f00 & (*from++ << 8);
                        *to = *from++;
-                       len -= 2;
+                       len -= 3;
                }
-               else if (*from == SS3)
+               else if (*from == SS3 && len >= 3)
                {
                        from++;
                        *to = *from++ << 8;
                        *to |= 0x3f & *from++;
                        len -= 3;
                }
-               else if (*from & 0x80)
+               else if ((*from & 0x80) && len >= 2)
                {
                        *to = *from++ << 8;
                        *to |= *from++;
@@ -195,25 +193,24 @@ static int pg_euctw2wchar_with_len
 {
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
-               if (*from == SS2)
+               if (*from == SS2 && len >= 4)
                {
                        from++;
-                       len--;
                        *to = *from++ << 16;
                        *to |= *from++ << 8;
                        *to |= *from++;
-                       len -= 3;
+                       len -= 4;
                }
-               else if (*from == SS3)
+               else if (*from == SS3 && len >= 3)
                {
                        from++;
                        *to = *from++ << 8;
                        *to |= 0x3f & *from++;
                        len -= 3;
                }
-               else if (*from & 0x80)
+               else if ((*from & 0x80) && len >= 2)
                {
                        *to = *from++ << 8;
                        *to |= *from++;
@@ -261,30 +258,30 @@ pg_utf2wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
                                c3;
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
                if ((*from & 0x80) == 0)
                {
                        *to = *from++;
                        len--;
                }
-               else if ((*from & 0xe0) == 0xc0)
+               else if ((*from & 0xe0) == 0xc0 && len >= 2)
                {
                        c1 = *from++ & 0x1f;
                        c2 = *from++ & 0x3f;
-                       len -= 2;
                        *to = c1 << 6;
                        *to |= c2;
+                       len -= 2;
                }
-               else if ((*from & 0xe0) == 0xe0)
+               else if ((*from & 0xe0) == 0xe0 && len >= 3)
                {
                        c1 = *from++ & 0x0f;
                        c2 = *from++ & 0x3f;
                        c3 = *from++ & 0x3f;
-                       len -= 3;
                        *to = c1 << 12;
                        *to |= c2 << 6;
                        *to |= c3;
+                       len -= 3;
                }
                else
                {
@@ -326,29 +323,29 @@ pg_mule2wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
 {
        int cnt = 0;
 
-       while (*from && len > 0)
+       while (len > 0 && *from)
        {
-               if (IS_LC1(*from))
+               if (IS_LC1(*from) && len >= 2)
                {
                        *to = *from++ << 16;
                        *to |= *from++;
                        len -= 2;
                }
-               else if (IS_LCPRV1(*from))
+               else if (IS_LCPRV1(*from) && len >= 3)
                {
                        from++;
                        *to = *from++ << 16;
                        *to |= *from++;
                        len -= 3;
                }
-               else if (IS_LC2(*from))
+               else if (IS_LC2(*from) && len >= 3)
                {
                        *to = *from++ << 16;
                        *to |= *from++ << 8;
                        *to |= *from++;
                        len -= 3;
                }
-               else if (IS_LCPRV2(*from))
+               else if (IS_LCPRV2(*from) && len >= 4)
                {
                        from++;
                        *to = *from++ << 16;
@@ -396,9 +393,10 @@ pg_latin12wchar_with_len(const unsigned char *from, pg_wchar * to, int len)
 {
        int cnt = 0;
 
-       while (*from && len-- > 0)
+       while (len > 0 && *from)
        {
                *to++ = *from++;
+               len--;
                cnt++;
        }
        *to = 0;