Patch applied. Thanks.
--------------------------------------------------------------------------- Neil Conway wrote: > Sir Mordred The Traitor <[EMAIL PROTECTED]> writes: > > Upon invoking a polygon(integer, circle) function a > > src/backend/utils/adt/geo_ops.c:circle_poly() function will gets > > called, which suffers from a buffer overflow. > > > > 2) A src/backend/adt/utils/geo_ops.c:path_encode() fails to detect a > > buffer overrun condition. It is called in multiple places, the most > > interesting are path_out() and poly_out() functions. > > > 5) A src/backend/utils/adt/geo_ops.c:path_add() also fails to detect > > a simple buffer overrun. > > I've attached a patch which should fix these problems. > > > 3) Upon converting a char string to a path object, a > > src/backend/utils/adt/geo_ops.c:path_in() function will gets called, > > which suffers from a buffer overrun, caused by a very long argument. > > > 4) A src/backend/utils/adt/geo_ops.c:poly_in() function fails to > > detect a buffer overrun condition caused by a very long argument. > > I wasn't able to reproduce either of these (wouldn't it require an > input string with several hundred thousand commas?), can you give me a > test-case? > > Cheers, > > Neil > > -- > Neil Conway <[EMAIL PROTECTED]> || PGP Key ID: DB3C29FC [ Attachment, skipping... ] > > ---------------------------(end of broadcast)--------------------------- > TIP 6: Have you searched our list archives? > > http://archives.postgresql.org -- Bruce Momjian | http://candle.pha.pa.us [EMAIL PROTECTED] | (610) 359-1001 + If your life is a hard drive, | 13 Roberts Road + Christ can be your backup. | Newtown Square, Pennsylvania 19073 ---------------------------(end of broadcast)--------------------------- TIP 2: you can get off all lists at once with the unregister command (send "unregister YourEmailAddressHere" to [EMAIL PROTECTED])