Skip to content

PgBatchConnection may pass strings without a null terminator to libpq APIs #2328

@LordMZTE

Description

@LordMZTE

Describe the bug
This code:

may invoke PQsendPrepare with a C-style string that's missing a null terminator.

To Reproduce
Execute an SQL statement with a DbConnection, passing an std::string_view that doesn't have a null terminator in order to call this function:

internal::SqlBinder operator<<(const std::string_view &sql)
{
return internal::SqlBinder(sql.data(), sql.length(), *this, type_);
}

Expected behavior
We add a null terminator if we can't be sure we already have one.

Desktop (please complete the following information):

  • OS: NixOS
  • Browser: Firefox
  • Version: 1.9.10

Additional context
This gist is my code and log output when I initially encountered this; here, the symptom is that multiple SQL statements are incorrectly combined: https://gist.github.com/LordMZTE/9b707013112b870196ae9f95e4a748f5

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions