Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the

byte after the last full byte of the bit array, regardless of whether that
byte was part of the valid data or not.  Found by buildfarm testing.
Thanks to Stefan Kaltenbrunner for nailing down the cause.

diff --git a/src/backend/utils/adt/varbit.c b/src/backend/utils/adt/varbit.c
index ca622e47a55f714c3d10ff84f02b40692a80d610..13ea9f1cbadd2f3e2c8806c114c097c6d4993a35 100644 (file)
--- a/src/backend/utils/adt/varbit.c
+++ b/src/backend/utils/adt/varbit.c
@@ -537,8 +537,9 @@ varbit_out(PG_FUNCTION_ARGS)
        result = (char *) palloc(len + 1);
        sp = VARBITS(s);
        r = result;
-       for (i = 0; i < len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
+       for (i = 0; i <= len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
        {
+               /* print full bytes */
                x = *sp;
                for (k = 0; k < BITS_PER_BYTE; k++)
                {
@@ -546,11 +547,15 @@ varbit_out(PG_FUNCTION_ARGS)
                        x <<= 1;
                }
        }
-       x = *sp;
-       for (k = i; k < len; k++)
+       if (i < len)
        {
-               *r++ = IS_HIGHBIT_SET(x) ? '1' : '0';
-               x <<= 1;
+               /* print the last partial byte */
+               x = *sp;
+               for (k = i; k < len; k++)
+               {
+                       *r++ = IS_HIGHBIT_SET(x) ? '1' : '0';
+                       x <<= 1;
+               }
        }
        *r = '\0';