sources/hba.c: fix memory overrun

yandex / odyssey

Scalable PostgreSQL connection pooler

BSD 3-Clause "New" or "Revised" License

3.13k stars 155 forks source link

sources/hba.c: fix memory overrun #618

Closed chipitsine closed 3 weeks ago

chipitsine commented 3 weeks ago

found by coverity

CID 477241: (#1 of 1): Out-of-bounds access (OVERRUN)
1. overrun-buffer-arg: Overrunning buffer pointed to by &rules of 8 bytes by passing it to a function which accesses it at byte offset 15 using argument 16UL.
 37        memcpy(&hba->rules, &rules, sizeof(hba->rules));

chipitsine commented 3 weeks ago

I officially hate C-style lists. Thanks for fixing this.

I think that ASAN should have caught that.

is there a probability that some functions are not covered by tests ? maybe we should invest into coverage (which is relatively easy)

x4m commented 3 weeks ago

Well, exactly this one is not exercised in HBA tests. https://github.com/yandex/odyssey/blob/master/docker/hba/test.sh