Sir Mordred The Traitor <mordred@s-mail.com> writes: > Upon invoking a polygon(integer, circle) function a > src/backend/utils/adt/geo_ops.c:circle_poly() function will gets > called, which suffers from a buffer overflow. > > 2) A src/backend/adt/utils/geo_ops.c:path_encode() fails to detect a > buffer overrun condition. It is called in multiple places, the most > interesting are path_out() and poly_out() functions.
Sir Mordred The Traitor <mordred@s-mail.com> writes:
> Upon invoking a polygon(integer, circle) function a
> src/backend/utils/adt/geo_ops.c:circle_poly() function will gets
> called, which suffers from a buffer overflow.
>
> 2) A src/backend/adt/utils/geo_ops.c:path_encode() fails to detect a
> buffer overrun condition. It is called in multiple places, the most
> interesting are path_out() and poly_out() functions.

> 5) A src/backend/utils/adt/geo_ops.c:path_add() also fails to detect
> a simple buffer overrun.

I've attached a patch which should fix these problems.

Neil Conway

pavanvd/postgres-xl,foyzur/gpdb,oberstet/postgres-xl,royc1/gpdb,arcivanov/postgres-xl,randomtask1155/gpdb,edespino/gpdb,greenplum-db/gpdb,0x0FFF/gpdb,xinzweb/gpdb,Chibin/gpdb,Chibin/gpdb,yazun/postgres-xl,chrishajas/gpdb,ashwinstar/gpdb,tangp3/gpdb,cjcjameson/gpdb,ashwinstar/gpdb,atris/gpdb,techdragon/Postgres-XL,adam8157/gpdb,lintzc/gpdb,yuanzhao/gpdb,postmind-net/postgres-xl,chrishajas/gpdb,lintzc/gpdb,kmjungersen/PostgresXL,royc1/gpdb,royc1/gpdb,ahachete/gpdb,lintzc/gpdb,lisakowen/gpdb,techdragon/Postgres-XL,xinzweb/gpdb,ovr/postgres-xl,jmcatamney/gpdb,Chibin/gpdb,Postgres-XL/Postgres-XL,zeroae/postgres-xl,rubikloud/gpdb,edespino/gpdb,Quikling/gpdb,ahachete/gpdb,ovr/postgres-xl,kmjungersen/PostgresXL,xuegang/gpdb,CraigHarris/gpdb,zaksoup/gpdb,jmcatamney/gpdb,rubikloud/gpdb,jmcatamney/gpdb,ashwinstar/gpdb,CraigHarris/gpdb,kaknikhil/gpdb,rvs/gpdb,xinzweb/gpdb,CraigHarris/gpdb,rubikloud/gpdb,Postgres-XL/Postgres-XL,zaksoup/gpdb,Chibin/gpdb,chrishajas/gpdb,kaknikhil/gpdb,adam8157/gpdb,xuegang/gpdb,tangp3/gpdb,yuanzhao/gpdb,royc1/gpdb,greenplum-db/gpdb,adam8157/gpdb,postmind-net/postgres-xl,jmcatamney/gpdb,atris/gpdb,janebeckman/gpdb,xinzweb/gpdb,Quikling/gpdb,Quikling/gpdb,janebeckman/gpdb,zaksoup/gpdb,Quikling/gpdb,edespino/gpdb,rvs/gpdb,jmcatamney/gpdb,rvs/gpdb,edespino/gpdb,foyzur/gpdb,greenplum-db/gpdb,lpetrov-pivotal/gpdb,Chibin/gpdb,techdragon/Postgres-XL,edespino/gpdb,techdragon/Postgres-XL,tpostgres-projects/tPostgres,0x0FFF/gpdb,xinzweb/gpdb,snaga/postgres-xl,lintzc/gpdb,foyzur/gpdb,foyzur/gpdb,tangp3/gpdb,kmjungersen/PostgresXL,ahachete/gpdb,xuegang/gpdb,rvs/gpdb,janebeckman/gpdb,jmcatamney/gpdb,kaknikhil/gpdb,greenplum-db/gpdb,adam8157/gpdb,arcivanov/postgres-xl,edespino/gpdb,rubikloud/gpdb,0x0FFF/gpdb,cjcjameson/gpdb,greenplum-db/gpdb,yuanzhao/gpdb,foyzur/gpdb,royc1/gpdb,janebeckman/gpdb,edespino/gpdb,lintzc/gpdb,rubikloud/gpdb,lpetrov-pivotal/gpdb,greenplum-db/gpdb,janebeckman/gpdb,zeroae/postgres-xl,pavanvd/postgres-xl,tpostgres-projects/tPostgres,Quikling/gpdb,randomtask1155/gpdb,jmcatamney/gpdb,zaksoup/gpdb,cjcjameson/gpdb,tangp3/gpdb,tangp3/gpdb,randomtask1155/gpdb,yuanzhao/gpdb,50wu/gpdb,kaknikhil/gpdb,50wu/gpdb,lintzc/gpdb,lintzc/gpdb,rubikloud/gpdb,kaknikhil/gpdb,cjcjameson/gpdb,tangp3/gpdb,atris/gpdb,atris/gpdb,yuanzhao/gpdb,oberstet/postgres-xl,cjcjameson/gpdb,kaknikhil/gpdb,yazun/postgres-xl,ahachete/gpdb,yuanzhao/gpdb,50wu/gpdb,lpetrov-pivotal/gpdb,lisakowen/gpdb,snaga/postgres-xl,lpetrov-pivotal/gpdb,greenplum-db/gpdb,kaknikhil/gpdb,rvs/gpdb,zeroae/postgres-xl,tangp3/gpdb,tpostgres-projects/tPostgres,lisakowen/gpdb,kaknikhil/gpdb,50wu/gpdb,arcivanov/postgres-xl,rvs/gpdb,chrishajas/gpdb,CraigHarris/gpdb,postmind-net/postgres-xl,janebeckman/gpdb,royc1/gpdb,yazun/postgres-xl,ahachete/gpdb,yuanzhao/gpdb,Chibin/gpdb,50wu/gpdb,pavanvd/postgres-xl,Chibin/gpdb,snaga/postgres-xl,zaksoup/gpdb,yuanzhao/gpdb,randomtask1155/gpdb,atris/gpdb,Chibin/gpdb,ahachete/gpdb,Postgres-XL/Postgres-XL,randomtask1155/gpdb,lpetrov-pivotal/gpdb,xuegang/gpdb,oberstet/postgres-xl,cjcjameson/gpdb,lisakowen/gpdb,zeroae/postgres-xl,janebeckman/gpdb,zaksoup/gpdb,kaknikhil/gpdb,lisakowen/gpdb,chrishajas/gpdb,xuegang/gpdb,postmind-net/postgres-xl,tpostgres-projects/tPostgres,CraigHarris/gpdb,yuanzhao/gpdb,rvs/gpdb,rvs/gpdb,50wu/gpdb,zaksoup/gpdb,0x0FFF/gpdb,pavanvd/postgres-xl,ashwinstar/gpdb,kmjungersen/PostgresXL,0x0FFF/gpdb,oberstet/postgres-xl,Quikling/gpdb,edespino/gpdb,adam8157/gpdb,randomtask1155/gpdb,Chibin/gpdb,lisakowen/gpdb,greenplum-db/gpdb,royc1/gpdb,atris/gpdb,Chibin/gpdb,xuegang/gpdb,foyzur/gpdb,rubikloud/gpdb,Postgres-XL/Postgres-XL,ovr/postgres-xl,adam8157/gpdb,arcivanov/postgres-xl,yazun/postgres-xl,Quikling/gpdb,lisakowen/gpdb,lpetrov-pivotal/gpdb,postmind-net/postgres-xl,ashwinstar/gpdb,atris/gpdb,Quikling/gpdb,randomtask1155/gpdb,CraigHarris/gpdb,Postgres-XL/Postgres-XL,atris/gpdb,adam8157/gpdb,0x0FFF/gpdb,ashwinstar/gpdb,janebeckman/gpdb,arcivanov/postgres-xl,xinzweb/gpdb,rvs/gpdb,50wu/gpdb,Quikling/gpdb,kmjungersen/PostgresXL,CraigHarris/gpdb,pavanvd/postgres-xl,chrishajas/gpdb,xinzweb/gpdb,janebeckman/gpdb,xinzweb/gpdb,ahachete/gpdb,snaga/postgres-xl,zaksoup/gpdb,chrishajas/gpdb,lisakowen/gpdb,jmcatamney/gpdb,lintzc/gpdb,0x0FFF/gpdb,xuegang/gpdb,cjcjameson/gpdb,lintzc/gpdb,yazun/postgres-xl,oberstet/postgres-xl,0x0FFF/gpdb,xuegang/gpdb,rvs/gpdb,tangp3/gpdb,yuanzhao/gpdb,foyzur/gpdb,CraigHarris/gpdb,50wu/gpdb,randomtask1155/gpdb,arcivanov/postgres-xl,edespino/gpdb,Quikling/gpdb,lpetrov-pivotal/gpdb,adam8157/gpdb,cjcjameson/gpdb,zeroae/postgres-xl,ahachete/gpdb,ovr/postgres-xl,janebeckman/gpdb,tpostgres-projects/tPostgres,CraigHarris/gpdb,rubikloud/gpdb,edespino/gpdb,xuegang/gpdb,lpetrov-pivotal/gpdb,techdragon/Postgres-XL,snaga/postgres-xl,kaknikhil/gpdb,chrishajas/gpdb,cjcjameson/gpdb,foyzur/gpdb,ovr/postgres-xl,ashwinstar/gpdb,cjcjameson/gpdb,ashwinstar/gpdb,royc1/gpdb