Description
Array out-of-bounds access in token_is_col_id() function when token is not found in keyword list.
Location
- File:
src/backend/oracle_parser/liboracle_parser.c
- Lines: 316-317
Problem
for (i = 0; i < OraScanKeywords.num_keywords; i++)
{
if (OraScanKeywordTokens[i] == token)
break;
}
// BUG: If token not found, i == OraScanKeywords.num_keywords (out of bounds!)
if (OraScanKeywordCategories[i] == UNRESERVED_KEYWORD ||
OraScanKeywordCategories[i] == COL_NAME_KEYWORD)
return true;If the token is not found in the loop, i will equal OraScanKeywords.num_keywords, which is beyond the valid bounds of OraScanKeywordCategories[].
Impact
- Buffer over-read
- Potential crash or information disclosure
Suggested Fix
if (i < OraScanKeywords.num_keywords &&
(OraScanKeywordCategories[i] == UNRESERVED_KEYWORD ||
OraScanKeywordCategories[i] == COL_NAME_KEYWORD))
return true;
Description
Array out-of-bounds access in
token_is_col_id()function when token is not found in keyword list.Location
src/backend/oracle_parser/liboracle_parser.cProblem
If the token is not found in the loop, i will equal OraScanKeywords.num_keywords, which is beyond the valid bounds of OraScanKeywordCategories[].
Impact
Suggested Fix