Avoid potential buffer overflow crash

A pointer to a C string was treated as a pointer to a "name" datum and
passed to SPI_execute_plan().  This pointer would then end up being
passed through datumCopy(), which would try to copy the entire 64 bytes
of name data, thus running past the end of the C string.  Fix by
converting the string to a proper name structure.

Found by LLVM AddressSanitizer.

diff --git a/src/backend/utils/adt/ruleutils.c b/src/backend/utils/adt/ruleutils.c
index afab3811253e485d51bf2db4a2c9321564e28006..d4b2b8bc1909a6d718e8d5431a7b283c29b4818e 100644 (file)
--- a/src/backend/utils/adt/ruleutils.c
+++ b/src/backend/utils/adt/ruleutils.c
@@ -483,7 +483,7 @@ pg_get_viewdef_worker(Oid viewoid, int prettyFlags, int wrapColumn)
         * Get the pg_rewrite tuple for the view's SELECT rule
         */
        args[0] = ObjectIdGetDatum(viewoid);
-       args[1] = PointerGetDatum(ViewSelectRuleName);
+       args[1] = DirectFunctionCall1(namein, CStringGetDatum(ViewSelectRuleName));
        nulls[0] = ' ';
        nulls[1] = ' ';
        spirc = SPI_execute_plan(plan_getviewrule, args, nulls, true, 2);