Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libpg_query crash #242

Open
ToSeven opened this issue Apr 11, 2024 · 0 comments
Open

libpg_query crash #242

ToSeven opened this issue Apr 11, 2024 · 0 comments

Comments

@ToSeven
Copy link

ToSeven commented Apr 11, 2024

#include "../pg_query.h"
#include <stdbool.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <math.h>
typedef uint8_t   u8;   
typedef uint16_t  u16;  
typedef uint32_t  u32;  
typedef uint64_t  u64;
typedef unsigned int usize;
typedef int8_t  i8;
typedef int16_t i16;
typedef int32_t i32;
typedef int64_t i64;
typedef int isize;
typedef float f32;
typedef double f64;
int main() {
    i8 v0_tmp[] = {-118, -12, -60, -77, 124, 58, 113, -79, 122, 5, -106, -56, 44, -73, -108, -74, -15, -63, 54, -23, 69, 23, 42, -9, -63, -102, -123, 23, -63, -18, 86, 0, }; // data
    i8 *v0 = malloc(sizeof v0_tmp);
    memcpy(v0, v0_tmp, sizeof v0_tmp);
    PgQueryProtobuf v1 = { 64, v0,  }; // parse_tree
    PgQueryDeparseResult v2 = pg_query_deparse_protobuf(v1); // $target
}

The function pg_query_deparse_protobuf doesn't check the actual length of the stream, which causes it to access the null pointer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant