Merge pull request IvorySQL#1170 from pierreforstmann/patch1

gaoxueyu · web-flow · commit 3588213e3d55 · 2026-01-26T15:47:28.000+08:00
fix [BUG] Array out-of-bounds read in token_is_col_id() - liboracle_p…
diff --git a/src/backend/oracle_parser/liboracle_parser.c b/src/backend/oracle_parser/liboracle_parser.c
@@ -313,8 +313,9 @@ token_is_col_id(int token)
 			break;
 	}
 
-	if (OraScanKeywordCategories[i]== UNRESERVED_KEYWORD ||
-		OraScanKeywordCategories[i]== COL_NAME_KEYWORD)
+	if (i < OraScanKeywords.num_keywords &&
+		(OraScanKeywordCategories[i]== UNRESERVED_KEYWORD ||
+		OraScanKeywordCategories[i]== COL_NAME_KEYWORD))
 		return true;
 	return false;
 }

Original file line number	Diff line number	Diff line change
`@@ -313,8 +313,9 @@ token_is_col_id(int token)`
`313`	`313`	`break;`
`314`	`314`	`}`
`315`	`315`
`316`		`- if (OraScanKeywordCategories[i]== UNRESERVED_KEYWORD \|\|`
`317`		`- OraScanKeywordCategories[i]== COL_NAME_KEYWORD)`
	`316`	`+ if (i < OraScanKeywords.num_keywords &&`
	`317`	`+ (OraScanKeywordCategories[i]== UNRESERVED_KEYWORD \|\|`
	`318`	`+ OraScanKeywordCategories[i]== COL_NAME_KEYWORD))`
`318`	`319`	`return true;`
`319`	`320`	`return false;`
`320`	`321`	`}`