Possible memory corruption (src/timezone/zic.c b/src/timezone/zic.c) - Mailing list pgsql-hackers

Hi,

Per Coverity.

overrun-buffer-val: Overrunning buffer pointed to by &c of 1 bytes by passing it to a function which accesses it at byte offset 4.

For some people, Coverity opinions count zero.

Who knows for others, it helps.

It doesn't matter if WideCharToMultiByte, it will fail or not, the danger exists.

If WideCharToMultiByte returns 4, memmove will possibly destroy 4 bytes.

The fix, use of the traditional and bogus C style, without tricks.

diff --git a/src/timezone/zic.c b/src/timezone/zic.c
index 0ea6ead2db..a5f7e7f1cd 100644
--- a/src/timezone/zic.c
+++ b/src/timezone/zic.c
@@ -1129,9 +1129,9 @@ static bool
 itssymlink(char const *name)
 {
 #ifdef HAVE_SYMLINK
- char c;
+ char linkpath[MAXPGPATH];
 
- return 0 <= readlink(name, &c, 1);
+ return 0 <= readlink(name, linkpath, sizeof(linkpath));
 #else
  return false;
 #endif

regards,

Ranier Vilela