Fix SPI_getvalue and SPI_getbinval to range-check the given attribute number

according to the TupleDesc's natts, not the number of physical columns in the
tuple.  The previous coding would do the wrong thing in cases where natts is
different from the tuple's column count: either incorrectly report error when
it should just treat the column as null, or actually crash due to indexing off
the end of the TupleDesc's attribute array.  (The second case is probably not
possible in modern PG versions, due to more careful handling of inheritance
cases than we once had.  But it's still a clear lack of robustness here.)

The incorrect error indication is ignored by all callers within the core PG
distribution, so this bug has no symptoms visible within the core code, but
it might well be an issue for add-on packages.  So patch all the way back.

diff --git a/src/backend/executor/spi.c b/src/backend/executor/spi.c
index 0b404228d80b4266681b3d6538de43db612dbe95..7a99a32b9a43b7e6c21a9285b550bdeb29c3b7c4 100644 (file)
--- a/src/backend/executor/spi.c
+++ b/src/backend/executor/spi.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *       $PostgreSQL: pgsql/src/backend/executor/spi.c,v 1.188.2.2 2008/09/15 23:37:49 tgl Exp $
+ *       $PostgreSQL: pgsql/src/backend/executor/spi.c,v 1.188.2.3 2008/10/16 13:23:28 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -677,7 +677,7 @@ SPI_getvalue(HeapTuple tuple, TupleDesc tupdesc, int fnumber)
 
        SPI_result = 0;
 
-       if (fnumber > HeapTupleHeaderGetNatts(tuple->t_data) || fnumber == 0 ||
+       if (fnumber > tupdesc->natts || fnumber == 0 ||
                fnumber <= FirstLowInvalidHeapAttributeNumber)
        {
                SPI_result = SPI_ERROR_NOATTRIBUTE;
@@ -718,7 +718,7 @@ SPI_getbinval(HeapTuple tuple, TupleDesc tupdesc, int fnumber, bool *isnull)
 {
        SPI_result = 0;
 
-       if (fnumber > HeapTupleHeaderGetNatts(tuple->t_data) || fnumber == 0 ||
+       if (fnumber > tupdesc->natts || fnumber == 0 ||
                fnumber <= FirstLowInvalidHeapAttributeNumber)
        {
                SPI_result = SPI_ERROR_NOATTRIBUTE;