OSSForks/postgres
1
0
Fork 0
mirror of https://github.com/zebrajr/postgres.git synced 2025-12-07 00:20:24 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sort out paired double quotes in \connect, \password and \crosstabview.

Browse Source 
In arguments, these meta-commands wrongly treated each pair as closing
the double quoted string.  Make the behavior match the documentation.
This is a compatibility break, but I more expect to find software with
untested reliance on the documented behavior than software reliant on
today's behavior.  Back-patch to 9.1 (all supported versions).

Reviewed by Tom Lane and Peter Eisentraut.

Security: CVE-2016-5424
This commit is contained in:
Noah Misch 2016-08-08 10:07:46 -04:00
parent 22f9b3dd3d
commit 0cc3b12d28
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/bin/psql/psqlscan.l
View File

@ -1556,7 +1556,8 @@ psql_scan_slash_option(PsqlScanState state,
/* Keep the first quote, remove the second */ /* Keep the first quote, remove the second */
cp++; cp++;
} }
inquotes = !inquotes; else
inquotes = !inquotes;
/* Collapse out quote at *cp */ /* Collapse out quote at *cp */
memmove(cp, cp + 1, strlen(cp)); memmove(cp, cp + 1, strlen(cp));
mybuf.len--; mybuf.len--;