diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-23 10:43:13 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-23 10:43:13 -0400 |
| commit | 384dfbde19330541f7fb487f9352949aa06c812e (patch) | |
| tree | 953af993af200021087f0b3adcd1569b75f6857b /src/backend/utils/adt/jsonfuncs.c | |
| parent | 8320c625d983f4cf4c8f453165502d7cf3aa7cf3 (diff) | |
| download | postgresql-384dfbde19330541f7fb487f9352949aa06c812e.tar.gz postgresql-384dfbde19330541f7fb487f9352949aa06c812e.zip | |
Fix unsafe use of strtol() on a non-null-terminated Text datum.
jsonb_set() could produce wrong answers or incorrect error reports, or in
the worst case even crash, when trying to convert a path-array element into
an integer for use as an array subscript. Per report from Vitaly Burovoy.
Back-patch to 9.5 where the faulty code was introduced (in commit
c6947010ceb42143).
Michael Paquier
Diffstat (limited to 'src/backend/utils/adt/jsonfuncs.c')
| -rw-r--r-- | src/backend/utils/adt/jsonfuncs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/backend/utils/adt/jsonfuncs.c b/src/backend/utils/adt/jsonfuncs.c index 363afa76990..cc6dadf7932 100644 --- a/src/backend/utils/adt/jsonfuncs.c +++ b/src/backend/utils/adt/jsonfuncs.c @@ -3873,7 +3873,7 @@ setPathArray(JsonbIterator **it, Datum *path_elems, bool *path_nulls, /* pick correct index */ if (level < path_len && !path_nulls[level]) { - char *c = VARDATA_ANY(path_elems[level]); + char *c = TextDatumGetCString(path_elems[level]); long lindex; errno = 0; |