Re: Buffer overflow in psql - Mailing list pgsql-general

Jack Orenstein <jorenstein@archivas.com> writes:
> The problem has occurred again, and I've found a buffer overflow in
> psql that explains it. Here is code from src/bin/psql/common.c, from
> the PrintQueryResults function:

>         case PGRES_COMMAND_OK:
>             {
>                 char        buf[10];

>                 success = true;
>                 sprintf(buf, "%u", (unsigned int) PQoidValue(results));

Good catch!  What platform and compiler are you using exactly?  I'd
imagine that on most platforms, the size of that array is effectively
rounded up to 12 bytes due to alignment/padding considerations, which
would mask the mistake.  Yours must somehow be putting something
critical right after the array.

> 1) Is one of the postgresql developers willing to get this fix into
>     the next release? (We're patching our own 7.4.8 build.)

Yeah, we'll fix it.

            regards, tom lane