Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible by

8, bitncmp() may dereference a pointer one byte out of bounds.

Chris Mikkelson (bug #5101)

diff --git a/src/backend/utils/adt/network.c b/src/backend/utils/adt/network.c
index 7eb6ffe306f78a1200a765fb3c603890d0d650d5..9a45bcbd290ffcebb0ef325543cd15ea70836b04 100644 (file)
--- a/src/backend/utils/adt/network.c
+++ b/src/backend/utils/adt/network.c
@@ -1,7 +1,7 @@
 /*
  * PostgreSQL type definitions for the INET and CIDR types.
  *
- * $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.72 2007/11/15 21:14:39 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/adt/network.c,v 1.72.2.1 2009/10/08 04:46:37 heikki Exp $
  *
  * Jon Postel RIP 16 Oct 1998
  */
@@ -994,7 +994,7 @@ bitncmp(void *l, void *r, int n)
 
    b = n / 8;
    x = memcmp(l, r, b);
-   if (x)
+   if (x || (n % 8) == 0)
        return x;
 
    lb = ((const u_char *) l)[b];