Thread: crash in LIBPQ_execute_query

crash in LIBPQ_execute_query

From
"Scot Loach"
Date:
Some of the queries we use can be very large.
My code is crashing here:

QResultClass *
LIBPQ_execute_query(ConnectionClass *self,char *query)                          {
        QResultClass *qres;                                                             PGresult *pgres;
        char            *ptr;
        char            cmdbuffer[ERROR_MSG_LENGTH + 1];
    char                errbuffer[ERROR_MSG_LENGTH + 1];                            int         pos=0;

        strcpy(cmdbuffer,query);


ERROR_MSG_LENGTH is 4096, my query is larger than that.
What's the rationale here and how do we fix it?  This works fine with the old driver.

Re: crash in LIBPQ_execute_query

From
"Merlin Moncure"
Date:
> Some of the queries we use can be very large.
> My code is crashing here:
>
> QResultClass *
> LIBPQ_execute_query(ConnectionClass *self,char *query)
> {
>         QResultClass *qres;
> PGresult *pgres;
>         char            *ptr;
>         char            cmdbuffer[ERROR_MSG_LENGTH + 1];
>     char                errbuffer[ERROR_MSG_LENGTH + 1];
> int         pos=0;
>
>         strcpy(cmdbuffer,query);
>
>
> ERROR_MSG_LENGTH is 4096, my query is larger than that.
> What's the rationale here and how do we fix it?  This works fine with
the
> old driver.

That code is fishy.  I should be making strncpy, not strcpy, and I don't
understand why ERROR_MSG_LENGTH is used for the length.  The query is
copied again (with strdup) inside QR_set_command.

IMO, it doesn't seem worthwhile to make the extra copy just to be able
to trim spaces leter.

Merlin

Re: crash in LIBPQ_execute_query

From
"Dave Page"
Date:

> -----Original Message-----
> From: pgsql-odbc-owner@postgresql.org
> [mailto:pgsql-odbc-owner@postgresql.org] On Behalf Of Scot Loach
> Sent: 02 September 2005 13:12
> To: pgsql-odbc@postgresql.org
> Subject: [ODBC] crash in LIBPQ_execute_query
>
> Some of the queries we use can be very large.
> My code is crashing here:
>
> QResultClass *
> LIBPQ_execute_query(ConnectionClass *self,char *query)
>                   {
>         QResultClass *qres;
>                           PGresult *pgres;
>         char            *ptr;
>         char            cmdbuffer[ERROR_MSG_LENGTH + 1];
>     char                errbuffer[ERROR_MSG_LENGTH + 1];
>                       int         pos=0;
>
>         strcpy(cmdbuffer,query);
>
>
> ERROR_MSG_LENGTH is 4096, my query is larger than that.
> What's the rationale here and how do we fix it?  This works
> fine with the old driver.

Urgh. To be honest, I can't see any need to copy that string at all in
there, so the limit is entirely unwarranted. In addition, there's code
in there marked #ifndef USE_LIBPQ (in LIBPQ_Execute!!), and, it sets the
rowcount to -1 if it can't find a space in the SQL query!

I've tidied that up - patch attached. Please let me know how it goes.

Regards, Dave

Attachment

Re: crash in LIBPQ_execute_query

From
"Scot Loach"
Date:
That seems to work.
Thanks for the quick reply Dave.

-----Original Message-----
From: Dave Page [mailto:dpage@vale-housing.co.uk]
Sent: Friday, September 02, 2005 8:58 AM
To: Scot Loach; pgsql-odbc@postgresql.org
Cc: Anoop Kumar
Subject: RE: [ODBC] crash in LIBPQ_execute_query




> -----Original Message-----
> From: pgsql-odbc-owner@postgresql.org
> [mailto:pgsql-odbc-owner@postgresql.org] On Behalf Of Scot Loach
> Sent: 02 September 2005 13:12
> To: pgsql-odbc@postgresql.org
> Subject: [ODBC] crash in LIBPQ_execute_query
>
> Some of the queries we use can be very large.
> My code is crashing here:
>
> QResultClass *
> LIBPQ_execute_query(ConnectionClass *self,char *query)
>                   {
>         QResultClass *qres;
>                           PGresult *pgres;
>         char            *ptr;
>         char            cmdbuffer[ERROR_MSG_LENGTH + 1];
>     char                errbuffer[ERROR_MSG_LENGTH + 1];
>                       int         pos=0;
>
>         strcpy(cmdbuffer,query);
>
>
> ERROR_MSG_LENGTH is 4096, my query is larger than that.
> What's the rationale here and how do we fix it?  This works
> fine with the old driver.

Urgh. To be honest, I can't see any need to copy that string at all in
there, so the limit is entirely unwarranted. In addition, there's code
in there marked #ifndef USE_LIBPQ (in LIBPQ_Execute!!), and, it sets the
rowcount to -1 if it can't find a space in the SQL query!

I've tidied that up - patch attached. Please let me know how it goes.

Regards, Dave

Re: crash in LIBPQ_execute_query

From
"Dave Page"
Date:
No probs. I'll apply it to CVS. Thanks for testing.

/D

> -----Original Message-----
> From: Scot Loach [mailto:sloach@sandvine.com]
> Sent: 02 September 2005 15:22
> To: Dave Page; pgsql-odbc@postgresql.org
> Cc: Anoop Kumar
> Subject: RE: [ODBC] crash in LIBPQ_execute_query
>
> That seems to work.
> Thanks for the quick reply Dave.
>
> -----Original Message-----
> From: Dave Page [mailto:dpage@vale-housing.co.uk]
> Sent: Friday, September 02, 2005 8:58 AM
> To: Scot Loach; pgsql-odbc@postgresql.org
> Cc: Anoop Kumar
> Subject: RE: [ODBC] crash in LIBPQ_execute_query
>
>
>
>
> > -----Original Message-----
> > From: pgsql-odbc-owner@postgresql.org
> > [mailto:pgsql-odbc-owner@postgresql.org] On Behalf Of Scot Loach
> > Sent: 02 September 2005 13:12
> > To: pgsql-odbc@postgresql.org
> > Subject: [ODBC] crash in LIBPQ_execute_query
> >
> > Some of the queries we use can be very large.
> > My code is crashing here:
> >
> > QResultClass *
> > LIBPQ_execute_query(ConnectionClass *self,char *query)
> >                   {
> >         QResultClass *qres;
> >                           PGresult *pgres;
> >         char            *ptr;
> >         char            cmdbuffer[ERROR_MSG_LENGTH + 1];
> >     char                errbuffer[ERROR_MSG_LENGTH + 1];
> >                       int         pos=0;
> >
> >         strcpy(cmdbuffer,query);
> >
> >
> > ERROR_MSG_LENGTH is 4096, my query is larger than that.
> > What's the rationale here and how do we fix it?  This works
> > fine with the old driver.
>
> Urgh. To be honest, I can't see any need to copy that string at all in
> there, so the limit is entirely unwarranted. In addition, there's code
> in there marked #ifndef USE_LIBPQ (in LIBPQ_Execute!!), and,
> it sets the
> rowcount to -1 if it can't find a space in the SQL query!
>
> I've tidied that up - patch attached. Please let me know how it goes.
>
> Regards, Dave
>