Re: [Resend] Sprintf() auditing and a patch - Mailing list pgsql-hackers

From Bruce Momjian
Subject Re: [Resend] Sprintf() auditing and a patch
Date
Msg-id 200208291843.g7TIhSs14454@candle.pha.pa.us
Whole thread Raw
In response to Re: [Resend] Sprintf() auditing and a patch  (Neil Conway <neilc@samurai.com>)
List pgsql-hackers
Neil Conway wrote:
> If you're interested, another common source of problems is integer
> overflow when dealing with numeric input from the user. In fact, far
> more security problems have been caused by insufficient integer
> overflow checking than by string handling bugs.

One other things that bothers me are cases where we allocate memory to
hold the ASCII representation of an integer, but instead of using a
macro that documents this fact, we use a constant, and different
constants in different places.  That should be cleaned up.

--  Bruce Momjian                        |  http://candle.pha.pa.us pgman@candle.pha.pa.us               |  (610)
359-1001+  If your life is a hard drive,     |  13 Roberts Road +  Christ can be your backup.        |  Newtown Square,
Pennsylvania19073
 


pgsql-hackers by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: C vs. C++ contributions
Next
From: "D'Arcy J.M. Cain"
Date:
Subject: Re: Type definition process (was Re: MemoryContextAlloc: invalid request size 1934906735)