MonetDB: Jul2015 - Properly check range of user ids.

[Sjoerd Mullender]

Changeset: 4cfcc5129159 for MonetDB
URL: http://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=4cfcc5129159
Modified Files:
        monetdb5/mal/mal_authorize.c
Branch: Jul2015
Log Message:

Properly check range of user ids.


diffs (25 lines):

diff --git a/monetdb5/mal/mal_authorize.c b/monetdb5/mal/mal_authorize.c
--- a/monetdb5/mal/mal_authorize.c
+++ b/monetdb5/mal/mal_authorize.c
@@ -543,10 +543,10 @@ AUTHsetPassword(Client *c, str *username
 str
 AUTHresolveUser(str *username, oid *uid)
 {
-       BUN p = *uid;
+       BUN p;
        BATiter useri;
 
-       if (uid == NULL || *uid == oid_nil || *uid > BATcount(user))
+       if (uid == NULL || *uid == oid_nil || (p = (BUN) *uid) >= 
BATcount(user))
                throw(ILLARG, "resolveUser", "userid should not be nil");
 
        assert (username != NULL);
@@ -577,7 +577,7 @@ AUTHgetUsername(str *username, Client *c
         * happens, it may be a security breach/attempt, and hence
         * terminating the entire system seems like the right thing to do to
         * me. */
-       if (p == BUN_NONE || id > BATcount(user))
+       if (p == BUN_NONE || id >= BATcount(user))
                GDKfatal("Internal error: user id that doesn't exist: " OIDFMT, 
id);
 
        useri = bat_iterator(user);
_______________________________________________
checkin-list mailing list
checkin-list@monetdb.org
https://www.monetdb.org/mailman/listinfo/checkin-list