From bb8aa8da9a909128951ab93a4bfe5e32b54422c9 Mon Sep 17 00:00:00 2001 From: liuhy Date: Fri, 14 Aug 2026 06:07:49 -0700 Subject: [PATCH] Fix heap overrun parsing XML namespace declarations register_ns_from_csting() copied prefix/url tokens into StringInfo buffers with raw memcpy, bypassing the growth path; a token longer than the initial 1024 bytes overran the heap. Use appendBinaryStringInfo so the buffer grows and stays NUL-terminated. Closes #1603 --- contrib/ivorysql_ora/src/xml_functions/ora_xml_functions.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/ivorysql_ora/src/xml_functions/ora_xml_functions.c b/contrib/ivorysql_ora/src/xml_functions/ora_xml_functions.c index 23e8ac4f51b..a5e8d412946 100644 --- a/contrib/ivorysql_ora/src/xml_functions/ora_xml_functions.c +++ b/contrib/ivorysql_ora/src/xml_functions/ora_xml_functions.c @@ -557,14 +557,12 @@ register_ns_from_csting(xmlXPathContextPtr xpathCtx, char* nsList) /* get the prefix */ start = strchr(tmp.data, (int)':'); end = strchr(tmp.data, (int)'='); - memcpy(prefix.data, start + 1, end - start); - prefix.data[end - start -1] = '\0'; + appendBinaryStringInfo(&prefix, start + 1, end - start - 1); /* get the url */ p1 = strstr(tmp.data, "="); l1 = strlen(p1); - memcpy(url.data, p1 + 2, l1 - 3); - url.data[l1 - 3] = '\0'; + appendBinaryStringInfo(&url, p1 + 2, l1 - 3); /* do register namespace */ if (xmlXPathRegisterNs(xpathCtx, (xmlChar *)prefix.data, (xmlChar *)url.data) != 0)