Skip to content

PgBatchConnection may pass strings without a null terminator to libpq APIs #2328

@LordMZTE

Description

@LordMZTE

Describe the bug
This code:

may invoke PQsendPrepare with a C-style string that's missing a null terminator.

To Reproduce
Execute an SQL statement with a DbConnection, passing an std::string_view that doesn't have a null terminator in order to call this function:

internal::SqlBinder operator<<(const std::string_view &sql)
{
return internal::SqlBinder(sql.data(), sql.length(), *this, type_);
}

Expected behavior
We add a null terminator if we can't be sure we already have one.

Desktop (please complete the following information):

  • OS: NixOS
  • Browser: Firefox
  • Version: 1.9.10

Additional context
This gist is my code and log output when I initially encountered this; here, the symptom is that multiple SQL statements are incorrectly combined: https://gist.github.com/LordMZTE/9b707013112b870196ae9f95e4a748f5

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions