Sort out paired double quotes in \connect, \password and \crosstabview.

In arguments, these meta-commands wrongly treated each pair as closing
the double quoted string.  Make the behavior match the documentation.
This is a compatibility break, but I more expect to find software with
untested reliance on the documented behavior than software reliant on
today's behavior.  Back-patch to 9.1 (all supported versions).

Reviewed by Tom Lane and Peter Eisentraut.

Security: CVE-2016-5424
REL9_1_STABLE
Noah Misch 9 years ago
parent e8ccfaf86f
commit aed766ab55
  1. 3
      src/bin/psql/psqlscan.l

@ -1616,7 +1616,8 @@ psql_scan_slash_option(PsqlScanState state,
/* Keep the first quote, remove the second */
cp++;
}
inquotes = !inquotes;
else
inquotes = !inquotes;
/* Collapse out quote at *cp */
memmove(cp, cp + 1, strlen(cp));
mybuf.len--;

Loading…
Cancel
Save