Hi,
On exec.c, have two memory leaks, and a possible access beyond heap bounds, the 
patch tries to fix them.
According to documentation at:
https://en.cppreference.com/w/c/experimental/dynamic/strdup
"The returned pointer must be passed to free to avoid a memory leak. "

regards,
Ranier Vilela
diff --git a/src/common/exec.c b/src/common/exec.c
index 92dc3134a1..88a27cec78 100644
--- a/src/common/exec.c
+++ b/src/common/exec.c
@@ -72,14 +72,15 @@ validate_exec(const char *path)
 	int			is_x;
 
 #ifdef WIN32
-	char		path_exe[MAXPGPATH + sizeof(".exe") - 1];
+	char		path_exe[MAXPGPATH + sizeof(".exe")];
+	int             path_len;
 
 	/* Win32 requires a .exe suffix for stat() */
-	if (strlen(path) >= strlen(".exe") &&
-		pg_strcasecmp(path + strlen(path) - strlen(".exe"), ".exe") != 0)
+	path_len = strlen(path);
+	if (path_len >= (sizeof(".exe") - 1) &&
+		pg_strcasecmp(path + path_len - (sizeof(".exe") - 1), ".exe") != 0)
 	{
-		strlcpy(path_exe, path, sizeof(path_exe) - 4);
-		strcat(path_exe, ".exe");
+		snprintf(path_exe, sizeof(path_exe) - 5, "%s.exe", path);
 		path = path_exe;
 	}
 #endif
@@ -600,8 +601,10 @@ set_pglocale_pgservice(const char *argv0, const char *app)
 		snprintf(env_path, sizeof(env_path), "PGLOCALEDIR=%s", path);
 		canonicalize_path(env_path + 12);
 		dup_path = strdup(env_path);
-		if (dup_path)
-			putenv(dup_path);
+		if (dup_path) {
+		    putenv(dup_path);
+		    free(dup_path);
+                }
 	}
 #endif
 
@@ -613,8 +616,10 @@ set_pglocale_pgservice(const char *argv0, const char *app)
 		snprintf(env_path, sizeof(env_path), "PGSYSCONFDIR=%s", path);
 		canonicalize_path(env_path + 13);
 		dup_path = strdup(env_path);
-		if (dup_path)
-			putenv(dup_path);
+		if (dup_path) {
+		    putenv(dup_path);
+		    free(dup_path);
+                }
 	}
 }

Reply via email to