Commit 55bfdd1
committed
Fix array overrun in ecpg's version of ParseDateTime().
The code wrote a value into the caller's field[] array before checking
to see if there was room, which of course is backwards. Per report from
Michael Paquier.
I fixed the equivalent bug in the backend's version of this code way back
in 630684d, but failed to think about ecpg's copy. Fortunately
this doesn't look like it would be exploitable for anything worse than a
core dump: an external attacker would have no control over the single word
that gets written.1 parent 273b29d commit 55bfdd1
1 file changed
+2
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1682 | 1682 | | |
1683 | 1683 | | |
1684 | 1684 | | |
| 1685 | + | |
1685 | 1686 | | |
1686 | 1687 | | |
1687 | 1688 | | |
| |||
1695 | 1696 | | |
1696 | 1697 | | |
1697 | 1698 | | |
1698 | | - | |
1699 | 1699 | | |
1700 | 1700 | | |
| 1701 | + | |
1701 | 1702 | | |
1702 | 1703 | | |
1703 | 1704 | | |
| |||
0 commit comments