From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Tue, 21 Aug 2007 02:40:18 +0000 (+0000)
Subject: Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the
X-Git-Url: http://waps.l3s.uni-hannover.de/gitweb/?a=commitdiff_plain;h=96462c3c064b296e04c151d6d0f2b05e605c6169;p=users%2Fbernd%2Fpostgres.git

Fix potential access-off-the-end-of-memory in varbit_out(): it fetched the
byte after the last full byte of the bit array, regardless of whether that
byte was part of the valid data or not.  Found by buildfarm testing.
Thanks to Stefan Kaltenbrunner for nailing down the cause.
---

diff --git a/src/backend/utils/adt/varbit.c b/src/backend/utils/adt/varbit.c
index 22cab68903..b7641a0f9f 100644
--- a/src/backend/utils/adt/varbit.c
+++ b/src/backend/utils/adt/varbit.c
@@ -472,8 +472,9 @@ varbit_out(PG_FUNCTION_ARGS)
 	result = (char *) palloc(len + 1);
 	sp = VARBITS(s);
 	r = result;
-	for (i = 0; i < len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
+	for (i = 0; i <= len - BITS_PER_BYTE; i += BITS_PER_BYTE, sp++)
 	{
+		/* print full bytes */
 		x = *sp;
 		for (k = 0; k < BITS_PER_BYTE; k++)
 		{
@@ -481,11 +482,15 @@ varbit_out(PG_FUNCTION_ARGS)
 			x <<= 1;
 		}
 	}
-	x = *sp;
-	for (k = i; k < len; k++)
+	if (i < len)
 	{
-		*r++ = (x & BITHIGH) ? '1' : '0';
-		x <<= 1;
+		/* print the last partial byte */
+		x = *sp;
+		for (k = i; k < len; k++)
+		{
+			*r++ = (x & BITHIGH) ? '1' : '0';
+			x <<= 1;
+		}
 	}
 	*r = '\0';