Defend against function calls with more than 8 arguments (code

used to overrun its fixed-size arrays before detecting error; not cool).
Also, replace uses of magic constant '8' with 'MAXFARGS'.

diff --git a/src/backend/parser/parse_coerce.c b/src/backend/parser/parse_coerce.c
index 9e0e77b051b6ac7a794653e9ea7b9f65a192bb10..1563a0eef731e97644d05cc059d2852650669375 100644 (file)
--- a/src/backend/parser/parse_coerce.c
+++ b/src/backend/parser/parse_coerce.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/backend/parser/parse_coerce.c,v 2.17 1999/05/29 03:17:19 tgl Exp $
+ *       $Header: /cvsroot/pgsql/src/backend/parser/parse_coerce.c,v 2.18 1999/06/17 22:21:41 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -20,6 +20,7 @@
 #include "parser/parse_expr.h"
 
 #include "catalog/pg_type.h"
+#include "parser/parse_func.h"
 #include "parser/parse_type.h"
 #include "parser/parse_target.h"
 #include "parser/parse_coerce.h"
@@ -132,7 +133,7 @@ can_coerce_type(int nargs, Oid *input_typeids, Oid *func_typeids)
        HeapTuple       ftup;
        int                     i;
        Type            tp;
-       Oid                     oid_array[8];
+       Oid                     oid_array[MAXFARGS];
 
        /* run through argument list... */
        for (i = 0; i < nargs; i++)
@@ -160,7 +161,7 @@ can_coerce_type(int nargs, Oid *input_typeids, Oid *func_typeids)
                         */
                        else if (input_typeids[i] != UNKNOWNOID)
                        {
-                               MemSet(&oid_array[0], 0, 8 * sizeof(Oid));
+                               MemSet(oid_array, 0, MAXFARGS * sizeof(Oid));
                                oid_array[0] = input_typeids[i];
 
                                /*

diff --git a/src/backend/parser/parse_func.c b/src/backend/parser/parse_func.c
index 8fa8fb8b365a3cc8d7348220cf6978158b4bf4ee..6f676618474ad26c99f8afcc3b303a684d36dbd4 100644 (file)
--- a/src/backend/parser/parse_func.c
+++ b/src/backend/parser/parse_func.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/backend/parser/parse_func.c,v 1.46 1999/05/25 16:10:17 momjian Exp $
+ *       $Header: /cvsroot/pgsql/src/backend/parser/parse_func.c,v 1.47 1999/06/17 22:21:40 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -83,8 +83,6 @@ static Oid    agg_select_candidate(Oid typeid, CandidateList candidates);
 
 #define ISCOMPLEX(type) (typeidTypeRelid(type) ? true : false)
 
-#define MAXFARGS 8                             /* max # args to a c or postquel function */
-
 typedef struct _SuperQE
 {
        Oid                     sqe_relid;
@@ -241,9 +239,9 @@ Node *
 ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
                                  int *curr_resno, int precedence)
 {
-       Oid                     rettype = (Oid) 0;
-       Oid                     argrelid = (Oid) 0;
-       Oid                     funcid = (Oid) 0;
+       Oid                     rettype = InvalidOid;
+       Oid                     argrelid = InvalidOid;
+       Oid                     funcid = InvalidOid;
        List       *i = NIL;
        Node       *first_arg = NULL;
        char       *relname = NULL;
@@ -252,12 +250,12 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
        Oid                     relid;
        int                     nargs;
        Func       *funcnode;
-       Oid                     oid_array[8];
+       Oid                     oid_array[MAXFARGS];
        Oid                *true_oid_array;
        Node       *retval;
        bool            retset;
        bool            attisset = false;
-       Oid                     toid = (Oid) 0;
+       Oid                     toid = InvalidOid;
        Expr       *expr;
 
        if (fargs)
@@ -425,7 +423,7 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
         * transform relation name arguments into varnodes of the appropriate
         * form.
         */
-       MemSet(&oid_array[0], 0, 8 * sizeof(Oid));
+       MemSet(oid_array, 0, MAXFARGS * sizeof(Oid));
 
        nargs = 0;
        foreach(i, fargs)
@@ -477,6 +475,14 @@ ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
                                toid = exprType(pair);
                }
 
+               /* Most of the rest of the parser just assumes that functions do not
+                * have more than MAXFARGS parameters.  We have to test here to protect
+                * against array overruns, etc.
+                */
+               if (nargs >= MAXFARGS)
+                       elog(ERROR, "Cannot pass more than %d arguments to a function",
+                                MAXFARGS);
+
                oid_array[nargs++] = toid;
        }
 
@@ -638,7 +644,7 @@ static Oid
 funcid_get_rettype(Oid funcid)
 {
        HeapTuple       func_tuple = NULL;
-       Oid                     funcrettype = (Oid) 0;
+       Oid                     funcrettype = InvalidOid;
 
        func_tuple = SearchSysCacheTuple(PROOID,
                                                                         ObjectIdGetDatum(funcid),
@@ -701,8 +707,8 @@ func_get_candidates(char *funcname, int nargs)
                                        current_candidate = (CandidateList)
                                                palloc(sizeof(struct _CandidateList));
                                        current_candidate->args = (Oid *)
-                                               palloc(8 * sizeof(Oid));
-                                       MemSet(current_candidate->args, 0, 8 * sizeof(Oid));
+                                               palloc(MAXFARGS * sizeof(Oid));
+                                       MemSet(current_candidate->args, 0, MAXFARGS * sizeof(Oid));
                                        for (i = 0; i < nargs; i++)
                                                current_candidate->args[i] = pgProcP->proargtypes[i];
 
@@ -1337,7 +1343,7 @@ setup_tlist(char *attname, Oid relid)
                                                 type_mod,
                                                 get_attname(relid, attno),
                                                 0,
-                                                (Oid) 0,
+                                                InvalidOid,
                                                 false);
        varnode = makeVar(-1, attno, typeid, type_mod, 0, -1, attno);
 
@@ -1362,7 +1368,7 @@ setup_base_tlist(Oid typeid)
                                                 -1,
                                                 "<noname>",
                                                 0,
-                                                (Oid) 0,
+                                                InvalidOid,
                                                 false);
        varnode = makeVar(-1, 1, typeid, -1, 0, -1, 1);
        tle = makeTargetEntry(resnode, (Node *) varnode);

diff --git a/src/backend/parser/parse_target.c b/src/backend/parser/parse_target.c
index 563a48e1b4eaae8077d670b996db6a38e84f3e62..09f624fc7607b498e8f76365b67b5ce005d13079 100644 (file)
--- a/src/backend/parser/parse_target.c
+++ b/src/backend/parser/parse_target.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/backend/parser/parse_target.c,v 1.41 1999/05/29 03:17:20 tgl Exp $
+ *       $Header: /cvsroot/pgsql/src/backend/parser/parse_target.c,v 1.42 1999/06/17 22:21:41 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -712,7 +712,7 @@ SizeTargetExpr(ParseState *pstate,
        int                     i;
        HeapTuple       ftup;
        char       *funcname;
-       Oid                     oid_array[8];
+       Oid                     oid_array[MAXFARGS];
 
        FuncCall   *func;
        A_Const    *cons;
@@ -720,7 +720,7 @@ SizeTargetExpr(ParseState *pstate,
        funcname = typeidTypeName(attrtype);
        oid_array[0] = attrtype;
        oid_array[1] = INT4OID;
-       for (i = 2; i < 8; i++)
+       for (i = 2; i < MAXFARGS; i++)
                oid_array[i] = InvalidOid;
 
        /* attempt to find with arguments exactly as specified... */

diff --git a/src/include/parser/parse_func.h b/src/include/parser/parse_func.h
index b83929358c514a79903367b271c9f09e9c701bab..d3441a0ce89c52cf3b181554a58e8913c263ecbe 100644 (file)
--- a/src/include/parser/parse_func.h
+++ b/src/include/parser/parse_func.h
@@ -6,7 +6,7 @@
  *
  * Copyright (c) 1994, Regents of the University of California
  *
- * $Id: parse_func.h,v 1.15 1999/05/25 16:14:27 momjian Exp $
+ * $Id: parse_func.h,v 1.16 1999/06/17 22:21:40 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -20,6 +20,9 @@
 #include <parser/parse_func.h>
 #include <parser/parse_node.h>
 
+
+#define MAXFARGS 8                             /* max # args to a c or postquel function */
+
 /*
  *     This structure is used to explore the inheritance hierarchy above
  *     nodes in the type tree in order to disambiguate among polymorphic
@@ -47,7 +50,7 @@ extern Node *ParseNestedFuncOrColumn(ParseState *pstate, Attr *attr,
 extern Node *ParseFuncOrColumn(ParseState *pstate, char *funcname, List *fargs,
                                  int *curr_resno, int precedence);
 
-extern void
-                       func_error(char *caller, char *funcname, int nargs, Oid *argtypes, char *msg);
+extern void func_error(char *caller, char *funcname,
+                                          int nargs, Oid *argtypes, char *msg);
 
 #endif  /* PARSE_FUNC_H */