Prevent 4 more buffer overruns in the PL/PgSQL parser. This is just a

minimally-invasive fix for stable branches; a cleaner fix will be
committed to HEAD soon.

diff --git a/src/pl/plpgsql/src/gram.y b/src/pl/plpgsql/src/gram.y
index 66f6edf2463faf56dc49d1efdebba721239cbc38..753b19ba489c67e39107c151f53ef9f11af953a1 100644 (file)
--- a/src/pl/plpgsql/src/gram.y
+++ b/src/pl/plpgsql/src/gram.y
@@ -1711,6 +1711,15 @@ read_sql_construct(int until,
                                plpgsql_dstring_append(&ds, yytext);
                                break;
                }
+
+               /* Check for array overflow */
+               if (nparams >= 1024)
+               {
+                       plpgsql_error_lineno = lno;
+                       ereport(ERROR,
+                                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                        errmsg("too many variables specified in SQL statement")));
+               }
        }
 
        expr = malloc(sizeof(PLpgSQL_expr) + sizeof(int) * nparams - sizeof(int));
@@ -1856,6 +1865,15 @@ make_select_stmt(void)
 
                                        while ((tok = yylex()) == ',')
                                        {
+                                               /* Check for array overflow */
+                                               if (nfields >= 1024)
+                                               {
+                                                       plpgsql_error_lineno = plpgsql_scanner_lineno();
+                                                       ereport(ERROR,
+                                                                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                                                        errmsg("too many INTO variables specified")));
+                                               }
+
                                                tok = yylex();
                                                switch(tok)
                                                {
@@ -1918,6 +1936,15 @@ make_select_stmt(void)
                                plpgsql_dstring_append(&ds, yytext);
                                break;
                }
+
+               /* Check for array overflow */
+               if (nparams >= 1024)
+               {
+                       plpgsql_error_lineno = plpgsql_scanner_lineno();
+                       ereport(ERROR,
+                                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                        errmsg("too many variables specified in SQL statement")));
+               }
        }
 
        expr = malloc(sizeof(PLpgSQL_expr) + sizeof(int) * nparams - sizeof(int));
@@ -1989,6 +2016,15 @@ make_fetch_stmt(void)
 
                                while ((tok = yylex()) == ',')
                                {
+                                       /* Check for array overflow */
+                                       if (nfields >= 1024)
+                                       {
+                                               plpgsql_error_lineno = plpgsql_scanner_lineno();
+                                               ereport(ERROR,
+                                                               (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                                                errmsg("too many INTO variables specified")));
+                                       }
+
                                        tok = yylex();
                                        switch(tok)
                                        {