Invalid memory read in dbGetAttributePart

[Ambroz Bizjak]

There is a possibility of an invalid memory read in dbGetAttributePart. The value of pname[nameLen] is taken before it is certain that there are at least nameLen (non-null) characters in pname (which is indicated by compare==0). I have found this with Address Sanitizer.

Patch is attached. With this fix I see no other ASan errors.

[Ambroz Bizjak (ambroz-bizjak)]

3.14, 3.15 and 3.16 all appear to be affected.

[mdavidsaver (mdavidsaver)]

So it looks like this bug happens (at least) whenever dbNameToAddr() is called with an invalid field name shorter than 4 charactors (the default attributes are "RTYP" and "VERS"). For example, "record.Q" for an aiRecord.

[mdavidsaver (mdavidsaver)]

oh, great. Another LP collision.

[Andrew Johnson (anj)]

I agree this is a bug that needs fixing, but I can't apply your patch directly (see below). I am making equivalent changes though. That code isn't the easiest to understand, so I'll clarify what the routine is doing while I'm at it.

* The use of the int variable ch or a cast of pname[nameLen] to (int) is needed to prevent warnings on some compilers, which complain if you pass isalnum() a char.
* Your patch also clashes slightly with a recently applied change that fixed other issues in the dbGetAttributePart() routine.

I'm fixing this on the 3.14 branch; the change will percolate up to the other branches when I merge them up in due course.

Thanks!