pgsql: Fix Coverity warning about contrib/pgcrypto's mdc_finish(). - Mailing list pgsql-committers

From Tom Lane
Subject pgsql: Fix Coverity warning about contrib/pgcrypto's mdc_finish().
Date
Msg-id E1YHFws-0001V4-RZ@gemulon.postgresql.org
Whole thread Raw
List pgsql-committers
Fix Coverity warning about contrib/pgcrypto's mdc_finish().

Coverity points out that mdc_finish returns a pointer to a local buffer
(which of course is gone as soon as the function returns), leaving open
a risk of misbehaviors possibly as bad as a stack overwrite.

In reality, the only possible call site is in process_data_packets()
which does not examine the returned pointer at all.  So there's no
live bug, but nonetheless the code is confusing and risky.  Refactor
to avoid the issue by letting process_data_packets() call mdc_finish()
directly instead of going through the pullf_read() API.

Although this is only cosmetic, it seems good to back-patch so that
the logic in pgp-decrypt.c stays in sync across all branches.

Marko Kreen

Branch
------
REL9_4_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/70da7aeba1f845d2f0bb864031e0bea21b384ca7

Modified Files
--------------
contrib/pgcrypto/pgp-decrypt.c |   49 ++++++++++++++++------------------------
1 file changed, 19 insertions(+), 30 deletions(-)


pgsql-committers by date:

Previous
From: Tom Lane
Date:
Subject: pgsql: Fix Coverity warning about contrib/pgcrypto's mdc_finish().
Next
From: Tom Lane
Date:
Subject: pgsql: Fix Coverity warning about contrib/pgcrypto's mdc_finish().