Skip to content

Commit

Permalink
Prevent stack overflow in query-type functions.
Browse files Browse the repository at this point in the history
The tsquery, ltxtquery and query_int data types have a common ancestor.
Having acquired check_stack_depth() calls independently, each was
missing at least one call.  Back-patch to 9.0 (all supported versions).
  • Loading branch information
nmisch committed Oct 5, 2015
1 parent a0c02ed commit bed3f6d
Show file tree
Hide file tree
Showing 4 changed files with 13 additions and 0 deletions.
3 changes: 3 additions & 0 deletions contrib/intarray/_int_bool.c
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,9 @@ typedef struct
static void
infix(INFIX *in, bool first)
{
/* since this function recurses, it could be driven to stack overflow. */
check_stack_depth();

if (in->curpol->type == VAL)
{
RESIZEBUF(in, 11);
Expand Down
3 changes: 3 additions & 0 deletions contrib/ltree/ltxtquery_io.c
Original file line number Diff line number Diff line change
Expand Up @@ -416,6 +416,9 @@ while( ( (inf)->cur - (inf)->buf ) + (addsize) + 1 >= (inf)->buflen ) \
static void
infix(INFIX *in, bool first)
{
/* since this function recurses, it could be driven to stack overflow. */
check_stack_depth();

if (in->curpol->type == VAL)
{
char *op = in->op + in->curpol->distance;
Expand Down
4 changes: 4 additions & 0 deletions contrib/ltree/ltxtquery_op.c
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
#include <ctype.h>

#include "ltree.h"
#include "miscadmin.h"

PG_FUNCTION_INFO_V1(ltxtq_exec);
PG_FUNCTION_INFO_V1(ltxtq_rexec);
Expand All @@ -18,6 +19,9 @@ PG_FUNCTION_INFO_V1(ltxtq_rexec);
bool
ltree_execute(ITEM *curitem, void *checkval, bool calcnot, bool (*chkcond) (void *checkval, ITEM *val))
{
/* since this function recurses, it could be driven to stack overflow */
check_stack_depth();

if (curitem->type == VAL)
return (*chkcond) (checkval, curitem);
else if (curitem->val == (int32) '!')
Expand Down
3 changes: 3 additions & 0 deletions src/backend/utils/adt/tsquery_cleanup.c
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ maketree(QueryItem *in)
{
NODE *node = (NODE *) palloc(sizeof(NODE));

/* since this function recurses, it could be driven to stack overflow. */
check_stack_depth();

node->valnode = in;
node->right = node->left = NULL;
if (in->type == QI_OPR)
Expand Down

0 comments on commit bed3f6d

Please sign in to comment.