Re: segfaults

I've been working with Harald on his situation and wanted to update others 
on what we have found so far, since I believe we have found a bug.
Unfortunately, I do not believe it is tied to what Harald is seeing.

This bug should only show itself if a user passes the keywords for ALL of 
the following: database, host, port, user, password, sslmode.  With all 
the keywords used, it steps past the memory that it allocated by one byte. 
And even then, the bug might not show itself if the resulting dsn length 
is not a mod 4 (on systems with 4 byte alignment and the right compiler 
settings).

The reason for this is the initial string size is figured out to be all 
the parameters with no values for them:
 	len("dbname= user= password= host= port= sslmode=\0")
The string size is then increased based upon what the length of the passed 
in parameter values to be included are.  The memory for the string then 
gets allocated.

BUT, when the dbname is copied over to create the string, it has an 
additional space in front of the name, " dbname=".  Later on, the string 
does 'loose' this blank space in front, but not before a NULL termination 
extends beyond the boundary of the allocated memory, if all the keywords 
are passed in.


Solutions that I can see:
* increase the size_t l from 45 to 46 (line 147 in psycopgmodule.c)
or
* Decrement the idsn count by 1, memmove, then NULL terminate (around line 
177 in psycopgmodule.c)


Neither way is what I would call intuitive I have included a patch that 
increases the size_t by 1 since it seems a little easier to follow then 
the other solution.


Like I mentioned previously, this was not the cause of Harald's problem, 
but it is interesting that his problem seemed to disappear when passing 
the dsn string instead of having the keywords dynamically create the dsn 
string.  Another set of eyes looking at the dynamic dsn creation might 
find something else there, since nothing else is sticking out at this 
moment for me.


-jason

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

Index: psycopgmodule.c

===================================================================

--- psycopgmodule.c	(revision 936)

+++ psycopgmodule.c	(working copy)

@@ -144,7 +144,7 @@

       PyOS_snprintf(port, 16, "%d", iport);
 
     if (dsn_static == NULL) {
-        size_t l = 45; /* len("dbname= user= password= host= port= sslmode=\0") */
+        size_t l = 46; /* len(" dbname= user= password= host= port= sslmode=\0") */
 
         if (database) l += strlen(database);
         if (host) l += strlen(host);