No sanity checking performed on binary TIME parameters.

From: Andrew McNamara <andrewm(at)object-craft(dot)com(dot)au>
To: pgsql-hackers(at)postgresql(dot)org
Cc: Andrew McNamara <andrewm(at)object-craft(dot)com(dot)au>
Subject: No sanity checking performed on binary TIME parameters.
Date: 2009-05-25 04:20:44
Message-ID: E419F08D-B908-446D-9B1E-F3520163CE9C@object-craft.com.au
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

When submitting a query via the V3 binary protocol (PQexecParams,
paramFormats[n]=1), it appears the PostgreSQL server performs no range
checking on the passed values. Passing values greater than 24 hours
results in unpredictable results (dumps that cannot be restored,
strange output when printing the column in psql, etc). Tested with
version 8.1 and 8.2 (integer_datetimes is false).

Using my python ocpgdb module (http://code.google.com/p/ocpgdb/):

>>> db.execute('select %s::time::text', DateTimeDelta(0,23,59,59))
[('23:59:59',)]
>>> db.execute('select %s::time::text', DateTimeDelta(0,28,0,0))
[('K|\x1f',)]

ocpgdb has a lower-level API which is a thin layer on top of libpq -
exercising this directly to rule out any problems with the
mx.DateTime.DateTimeDelta class yields the same results:

>>> import struct
>>> import ocpgdb, oclibpq
>>> db=oclibpq.PgConnection('')
>>> list(db.execute('select $1::time::text', [(ocpgdb.pgoid.time,
struct.pack('!d', 23*60*60))]))
[(<PyPgCell name 'text', type 25, modifier -1, value '23:00:00' at
0x42a4a0>,)]
>>> list(db.execute('select $1::time::text', [(ocpgdb.pgoid.time,
struct.pack('!d', 48*60*60))]))
[(<PyPgCell name 'text', type 25, modifier -1, value 'K|\x1f' at
0x42a500>,)]

Apologies if this bug has already been addressed - I didn't find any
references to it while googling.

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Joshua Tolley 2009-05-25 04:47:29 Re: generic options for explain
Previous Message Michael Meskes 2009-05-25 03:24:40 Warnings in compile