Skip to content

PG-2540 Fix buffer overread and simplify code for parsing comments #752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeltz wants to merge 2 commits into
base: main
Choose a base branch
from
Open

PG-2540 Fix buffer overread and simplify code for parsing comments #752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
11ccd16
PG-2540 Fix bug with overread after comment end in extraction
jeltz Jul 8, 2026
97b3bb5
Simplify code for parsing comments
jeltz Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 28 additions & 31 deletions src/pg_stat_monitor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3167,13 +3167,9 @@ static bool
append_comment_char(char *comments, size_t buf_len, size_t *idx, char c)
{
if (*idx >= buf_len - 1)
{
comments[buf_len - 1] = '\0';
return false;
}

comments[*idx] = c;
(*idx)++;
comments[(*idx)++] = c;

return true;
}
Expand All @@ -3182,48 +3178,49 @@ static void
extract_query_comments(const char *query, char *comments, size_t buf_len)
{
size_t curr_len = 0;
const char *q_iter = query;

Assert(query != NULL);

while (*q_iter)
for (const char *q_iter = query; *q_iter;)
{
/*
* multiline comments, + 1 is safe even if we've reach end of string
*/
if (*q_iter == '/' && *(q_iter + 1) == '*')
{
if (curr_len != 0)
/* Add separator between comments */
if (curr_len > 0)
{
if (!append_comment_char(comments, buf_len, &curr_len, ','))
return;
goto terminate;
if (!append_comment_char(comments, buf_len, &curr_len, ' '))
return;
}
while (*q_iter && *(q_iter + 1) && (*q_iter != '*' || *(q_iter + 1) != '/'))
{
if (!append_comment_char(comments, buf_len, &curr_len, *q_iter))
return;
q_iter++;
goto terminate;
}

if (*q_iter)
{
if (!append_comment_char(comments, buf_len, &curr_len, *q_iter))
return;
q_iter++;
}
if (*q_iter)
if (!append_comment_char(comments, buf_len, &curr_len, *(q_iter++)))
goto terminate;
if (!append_comment_char(comments, buf_len, &curr_len, *(q_iter++)))
goto terminate;

while (*q_iter)
{
if (!append_comment_char(comments, buf_len, &curr_len, *q_iter))
return;
q_iter++;
if (*q_iter == '*' && *(q_iter + 1) == '/')
{
if (!append_comment_char(comments, buf_len, &curr_len, *(q_iter++)))
goto terminate;
if (!append_comment_char(comments, buf_len, &curr_len, *(q_iter++)))
goto terminate;
break;
}

if (!append_comment_char(comments, buf_len, &curr_len, *(q_iter++)))
goto terminate;
}
}

q_iter++;
else
{
q_iter++;
}
}

terminate:
comments[curr_len] = '\0';
}

Expand Down
12 changes: 12 additions & 0 deletions t/003_settings_pgms_extract_comments.pl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,18 @@
extra_params => [ '-a', '-Pformat=aligned', '-Ptuples_only=off' ]);
PGSM::append_to_file($stdout);

($cmdret, $stdout, $stderr) = $node->psql(
'postgres',
'SELECT 1 /* a *//* b */, 2, 3',
extra_params => [ '-a', '-Pformat=aligned', '-Ptuples_only=off' ]);
PGSM::append_to_file($stdout);

($cmdret, $stdout, $stderr) = $node->psql(
'postgres',
'SELECT 1, 2, 3, 4 /* x */',
extra_params => [ '-a', '-Pformat=aligned', '-Ptuples_only=off' ]);
PGSM::append_to_file($stdout);

($cmdret, $stdout, $stderr) = $node->psql(
'postgres',
'SELECT query, comments FROM pg_stat_monitor ORDER BY query COLLATE "C";',
Expand Down
16 changes: 15 additions & 1 deletion t/expected/003_settings_pgms_extract_comments.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,28 @@ SELECT 1 /* xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 | 2
(1 row)

SELECT 1 /* a *//* b */, 2, 3
?column? | ?column? | ?column?
----------+----------+----------
1 | 2 | 3
(1 row)

SELECT 1, 2, 3, 4 /* x */
?column? | ?column? | ?column? | ?column?
----------+----------+----------+----------
1 | 2 | 3 | 4
(1 row)

SELECT query, comments FROM pg_stat_monitor ORDER BY query COLLATE "C";
query | comments
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SELECT 1 /* a *//* b */, 2, 3 | /* a */
SELECT 1 /* xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx */, 2 | /* xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
SELECT 1 AS num /* First comment */, 'John' AS name /* Second comment*/ | /* First comment */, /* Second comment*/
SELECT 1, 2, 3, 4 /* x */ | /* x */
SELECT name, setting, unit, context, vartype, source, min_val, max_val, enumvals, boot_val, reset_val, pending_restart FROM pg_settings WHERE name = 'pg_stat_monitor.pgsm_extract_comments' |
SELECT pg_stat_monitor_reset() |
(4 rows)
(6 rows)

SELECT pg_stat_monitor_reset();
pg_stat_monitor_reset
Expand Down
Loading