diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2023-04-29 13:06:44 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2023-04-29 13:06:44 -0400 |
| commit | 1e868bb6c67a19614c0f30b69bd5b624d72b1245 (patch) | |
| tree | 2c4e2f748d98973f810996a740d48b29a2bc48a6 /src/backend/access/gist/gistbuildbuffers.c | |
| parent | a1d9aacc4128302129349cb1c86c7807f1555901 (diff) | |
| download | postgresql-1e868bb6c67a19614c0f30b69bd5b624d72b1245.tar.gz postgresql-1e868bb6c67a19614c0f30b69bd5b624d72b1245.zip | |
Tighten array dimensionality checks in Perl -> SQL array conversion.
plperl_array_to_datum() wasn't sufficiently careful about checking
that nested lists represent a rectangular array structure; it would
accept inputs such as "[1, []]". This is a bit related to the
PL/Python bug fixed in commit 81eaaf65e, but it doesn't seem to
provide any direct route to a memory stomp. Instead the likely
failure mode is for makeMdArrayResult to be passed fewer Datums than
the claimed array dimensionality requires, possibly leading to a wild
pointer dereference and SIGSEGV.
Per report from Alexander Lakhin. It's been broken for a long
time, so back-patch to all supported branches.
Discussion: https://postgr.es/m/5ebae5e4-d401-fadf-8585-ac3eaf53219c@gmail.com
Diffstat (limited to 'src/backend/access/gist/gistbuildbuffers.c')
0 files changed, 0 insertions, 0 deletions