The following issues were found

tsl/test/sql/continuous_aggs_dump.sql
7 issues
Syntax error at or near "\"
Syntax error

Line: 76 Column: 1

                GROUP BY bucket, location
  HAVING min(location) >= 'NYC' and avg(temperature) > 20
  $$ AS "QUERY_TEMPLATE"
\gset

SELECT
  replace(:'QUERY_TEMPLATE', 'TABLE', 'conditions_before') AS "QUERY_BEFORE",
  replace(:'QUERY_TEMPLATE', 'TABLE', 'conditions_after') AS "QUERY_AFTER"
\gset

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 114 Column: 1

              FROM _timescaledb_catalog.continuous_agg ca
INNER JOIN _timescaledb_catalog.hypertable h ON(h.id = ca.mat_hypertable_id)
WHERE user_VIEW_name = 'mat_before'
\gset

SELECT count(*) FROM conditions_before;
SELECT count(*) FROM conditions_after;

--dump & restore

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 120 Column: 1

              SELECT count(*) FROM conditions_after;

--dump & restore
\c postgres :ROLE_SUPERUSER
\! utils/pg_dump_aux_dump.sh dump/pg_dump.sql

\c :TEST_DBNAME
SET client_min_messages = ERROR;
CREATE EXTENSION timescaledb CASCADE;

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 130 Column: 1

              
--\! cp dump/pg_dump.sql /tmp/dump.sql
SELECT timescaledb_pre_restore();
\! utils/pg_dump_aux_restore.sh dump/pg_dump.sql
SELECT timescaledb_post_restore();
SELECT _timescaledb_internal.stop_background_workers();

\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 134 Column: 1

              SELECT timescaledb_post_restore();
SELECT _timescaledb_internal.stop_background_workers();

\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

--make sure the appropriate DROP are still blocked.
\set ON_ERROR_STOP 0
DROP table :"MAT_SCHEMA_NAME".:"MAT_TABLE_NAME";
DROP VIEW :"PART_VIEW_SCHEMA".:"PART_VIEW_NAME";

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 140 Column: 1

              \set ON_ERROR_STOP 0
DROP table :"MAT_SCHEMA_NAME".:"MAT_TABLE_NAME";
DROP VIEW :"PART_VIEW_SCHEMA".:"PART_VIEW_NAME";
\set ON_ERROR_STOP 1

--materialize mat_after
CALL refresh_continuous_aggregate('mat_after', NULL, NULL);
SELECT count(*) FROM mat_after;


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 149 Column: 1

              --compare results
SELECT count(*) FROM conditions_before;
SELECT count(*) FROM conditions_after;
\set VIEW_NAME mat_before
\set QUERY :QUERY_BEFORE
\set ECHO errors
\ir include/cont_agg_test_equal.sql
\set ECHO all
\set VIEW_NAME mat_after

            

Reported by SQLint.

src/net/http_request.c
7 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 30 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	memset(new_header, 0, sizeof(*new_header));
	new_header->name = palloc(name_len + 1);
	if (name_len > 0)
		memcpy(new_header->name, name, name_len);
	new_header->name[name_len] = '\0';
	new_header->name_len = name_len;

	new_header->value = palloc(value_len + 1);
	if (value_len > 0)

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 36 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	new_header->value = palloc(value_len + 1);
	if (value_len > 0)
		memcpy(new_header->value, value, value_len);
	new_header->value[value_len] = '\0';
	new_header->value_len = value_len;

	new_header->next = next;
	return new_header;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 109 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	int uri_len = strlen(uri);

	req->uri = palloc(uri_len + 1);
	memcpy(req->uri, uri, uri_len);
	req->uri[uri_len] = '\0';
	req->uri_len = uri_len;
	MemoryContextSwitchTo(old);
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 139 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	MemoryContext old = MemoryContextSwitchTo(req->context);

	req->body = palloc(body_len + 1);
	memcpy(req->body, body, body_len);
	req->body[body_len] = '\0';
	req->body_len = body_len;
	MemoryContextSwitchTo(old);
}


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 106 Column: 16 CWE codes: 126

              ts_http_request_set_uri(HttpRequest *req, const char *uri)
{
	MemoryContext old = MemoryContextSwitchTo(req->context);
	int uri_len = strlen(uri);

	req->uri = palloc(uri_len + 1);
	memcpy(req->uri, uri, uri_len);
	req->uri[uri_len] = '\0';
	req->uri_len = uri_len;

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 125 Column: 17 CWE codes: 126

              ts_http_request_set_header(HttpRequest *req, const char *name, const char *value)
{
	MemoryContext old = MemoryContextSwitchTo(req->context);
	int name_len = strlen(name);
	int value_len = strlen(value);
	HttpHeader *new_header = ts_http_header_create(name, name_len, value, value_len, req->headers);

	req->headers = new_header;
	MemoryContextSwitchTo(old);

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 126 Column: 18 CWE codes: 126

              {
	MemoryContext old = MemoryContextSwitchTo(req->context);
	int name_len = strlen(name);
	int value_len = strlen(value);
	HttpHeader *new_header = ts_http_header_create(name, name_len, value, value_len, req->headers);

	req->headers = new_header;
	MemoryContextSwitchTo(old);
}

            

Reported by FlawFinder.

tsl/src/remote/connection.c
7 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1110 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              } PathKind;

/* Path description for human consumption */
static const char *path_kind_text[PATH_KIND_KEY + 1] = {
	[PATH_KIND_CRT] = "certificate",
	[PATH_KIND_KEY] = "private key",
};

/* Path extension string for file system */

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1116 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              };

/* Path extension string for file system */
static const char *path_kind_ext[PATH_KIND_KEY + 1] = {
	[PATH_KIND_CRT] = "crt",
	[PATH_KIND_KEY] = "key",
};

/*

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1150 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static StringInfo
make_user_path(const char *user_name, PathKind path_kind)
{
	char ret_path[MAXPGPATH];
	char hexsum[33];
	StringInfo result;

	pg_md5_hash(user_name, strlen(user_name), hexsum);


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1151 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              make_user_path(const char *user_name, PathKind path_kind)
{
	char ret_path[MAXPGPATH];
	char hexsum[33];
	StringInfo result;

	pg_md5_hash(user_name, strlen(user_name), hexsum);

	if (strlcpy(ret_path, ts_guc_ssl_dir ? ts_guc_ssl_dir : DataDir, MAXPGPATH) > MAXPGPATH)

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1841 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              remote_connection_cancel_query(TSConnection *conn)
{
	PGcancel *cancel;
	char errbuf[256];
	TimestampTz endtime;
	TSConnectionError err;
	bool success;

	if (!conn)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 307 Column: 18 CWE codes: 126

              
	sqlstate = err->remote.sqlstate;

	if (sqlstate && strlen(sqlstate) == 5)
		err->remote.errcode =
			MAKE_SQLSTATE(sqlstate[0], sqlstate[1], sqlstate[2], sqlstate[3], sqlstate[4]);
	else
		err->remote.errcode = ERRCODE_INTERNAL_ERROR;


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1154 Column: 25 CWE codes: 126

              	char hexsum[33];
	StringInfo result;

	pg_md5_hash(user_name, strlen(user_name), hexsum);

	if (strlcpy(ret_path, ts_guc_ssl_dir ? ts_guc_ssl_dir : DataDir, MAXPGPATH) > MAXPGPATH)
		report_path_error(path_kind, user_name);
	canonicalize_path(ret_path);


            

Reported by FlawFinder.

test/sql/drop_extension.sql
7 issues
Syntax error at or near "\"
Syntax error

Line: 12 Column: 1

              INSERT INTO drop_test VALUES('Mon Mar 20 09:17:00.936242 2017', 23.4, 'dev1');
SELECT * FROM drop_test;

\c :TEST_DBNAME :ROLE_SUPERUSER
DROP EXTENSION timescaledb CASCADE;
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

-- Querying the original table should not return any rows since all of
-- them actually existed in chunks that are now gone

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 14 Column: 1

              
\c :TEST_DBNAME :ROLE_SUPERUSER
DROP EXTENSION timescaledb CASCADE;
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

-- Querying the original table should not return any rows since all of
-- them actually existed in chunks that are now gone
SELECT * FROM drop_test;


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 20 Column: 1

              -- them actually existed in chunks that are now gone
SELECT * FROM drop_test;

\c :TEST_DBNAME :ROLE_SUPERUSER
-- Recreate the extension
SET client_min_messages=error;
CREATE EXTENSION timescaledb;
RESET client_min_messages;


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 27 Column: 1

              RESET client_min_messages;

-- Test that calling twice generates proper error
\set ON_ERROR_STOP 0
CREATE EXTENSION timescaledb;
\set ON_ERROR_STOP 1
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

-- CREATE twice with IF NOT EXISTS should be OK

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 29 Column: 1

              -- Test that calling twice generates proper error
\set ON_ERROR_STOP 0
CREATE EXTENSION timescaledb;
\set ON_ERROR_STOP 1
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

-- CREATE twice with IF NOT EXISTS should be OK
CREATE EXTENSION IF NOT EXISTS timescaledb;


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 43 Column: 1

              SELECT * FROM drop_test;

--test drops thru cascades of other objects
\c :TEST_DBNAME :ROLE_SUPERUSER

drop schema public cascade;
\dn

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 46 Column: 1

              \c :TEST_DBNAME :ROLE_SUPERUSER

drop schema public cascade;
\dn

            

Reported by SQLint.

tsl/test/shared/sql/dist_gapfill.sql
7 issues
Syntax error at or near "\"
Syntax error

Line: 5 Column: 1

              -- Please see the included NOTICE for copyright information and
-- LICENSE-TIMESCALE for a copy of the license.

\set ECHO errors

\set TEST_BASE_NAME dist_gapfill
\set TEST_METRICS_NAME gapfill_metrics
SELECT format('include/%s_query.sql', :'TEST_BASE_NAME') AS "TEST_QUERY_NAME",
    format('%s/shared/results/%s_singlenode.out', :'TEST_OUTPUT_DIR', :'TEST_BASE_NAME') AS "TEST_SINGLENODE",

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 47 Column: 1

              \set CONDITIONS conditions_dist

SET enable_partitionwise_aggregate = 'off';
\o :TEST_PARTITIONWISE_OFF
\ir :TEST_QUERY_NAME
\o

SET enable_partitionwise_aggregate = 'on';
\o :TEST_PARTITIONWISE_ON

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 52 Column: 1

              \o

SET enable_partitionwise_aggregate = 'on';
\o :TEST_PARTITIONWISE_ON
\ir :TEST_QUERY_NAME
\o

SET enable_partitionwise_aggregate = 'off';


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 59 Column: 1

              SET enable_partitionwise_aggregate = 'off';

-- gapfill_metrics_query
\set METRICS metrics_int_dist

\o :TEST_METRICS_PARTITIONWISE_OFF
\ir :TEST_METRICS_QUERY_NAME
\o


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 79 Column: 1

              \set CONDITIONS conditions_dist1

SET enable_partitionwise_aggregate = 'off';
\o :TEST_PARTITIONWISE_OFF
\ir :TEST_QUERY_NAME
\o

SET enable_partitionwise_aggregate = 'on';
\o :TEST_PARTITIONWISE_ON

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 84 Column: 1

              \o

SET enable_partitionwise_aggregate = 'on';
\o :TEST_PARTITIONWISE_ON
\ir :TEST_QUERY_NAME
\o

SET enable_partitionwise_aggregate = 'off';


            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 91 Column: 1

              SET enable_partitionwise_aggregate = 'off';

-- gapfill_metrics_query
\set METRICS metrics_int_dist1

\o :TEST_METRICS_PARTITIONWISE_OFF
\ir :TEST_METRICS_QUERY_NAME
\o


            

Reported by SQLint.

src/loader/bgw_launcher.c
7 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 267 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	 */
	worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
	worker.bgw_notify_pid = 0;
	snprintf(worker.bgw_library_name, BGW_MAXLEN, EXTENSION_NAME);
	snprintf(worker.bgw_function_name, BGW_MAXLEN, "ts_bgw_cluster_launcher_main");
	RegisterBackgroundWorker(&worker);
}

/*

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 289 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	worker.bgw_flags = BGWORKER_SHMEM_ACCESS | BGWORKER_BACKEND_DATABASE_CONNECTION;
	worker.bgw_restart_time = BGW_NEVER_RESTART;
	worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
	snprintf(worker.bgw_library_name, BGW_MAXLEN, EXTENSION_NAME);
	snprintf(worker.bgw_function_name, BGW_MAXLEN, BGW_ENTRYPOINT_FUNCNAME);
	worker.bgw_notify_pid = MyProcPid;
	worker.bgw_main_arg = ObjectIdGetDatum(db_id);
	memcpy(worker.bgw_extra, &vxid, sizeof(VirtualTransactionId));


            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 290 Column: 2 CWE codes: 134
Suggestion: Use a constant for the format specification

              	worker.bgw_restart_time = BGW_NEVER_RESTART;
	worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
	snprintf(worker.bgw_library_name, BGW_MAXLEN, EXTENSION_NAME);
	snprintf(worker.bgw_function_name, BGW_MAXLEN, BGW_ENTRYPOINT_FUNCNAME);
	worker.bgw_notify_pid = MyProcPid;
	worker.bgw_main_arg = ObjectIdGetDatum(db_id);
	memcpy(worker.bgw_extra, &vxid, sizeof(VirtualTransactionId));

	return RegisterDynamicBackgroundWorker(&worker, handle);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 293 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	snprintf(worker.bgw_function_name, BGW_MAXLEN, BGW_ENTRYPOINT_FUNCNAME);
	worker.bgw_notify_pid = MyProcPid;
	worker.bgw_main_arg = ObjectIdGetDatum(db_id);
	memcpy(worker.bgw_extra, &vxid, sizeof(VirtualTransactionId));

	return RegisterDynamicBackgroundWorker(&worker, handle);
}

/* Initializes the launcher's hash table of schedulers.

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 895 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              {
	Oid db_id = DatumGetObjectId(MyBgworkerEntry->bgw_main_arg);
	bool ts_installed = false;
	char version[MAX_VERSION_LEN];
	VirtualTransactionId vxid;

	pqsignal(SIGINT, StatementCancelHandler);
	pqsignal(SIGTERM, entrypoint_sigterm);
	BackgroundWorkerUnblockSignals();

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 912 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	 */
	StartTransactionCommand();
	(void) GetTransactionSnapshot();
	memcpy(&vxid, MyBgworkerEntry->bgw_extra, sizeof(VirtualTransactionId));
	if (VirtualTransactionIdIsValid(vxid))
		VirtualXactLock(vxid, true);
	CommitTransactionCommand();

	/*

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 939 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	CommitTransactionCommand();
	if (ts_installed)
	{
		char soname[MAX_SO_NAME_LEN];
		PGFunction versioned_scheduler_main;

		snprintf(soname, MAX_SO_NAME_LEN, "%s-%s", EXTENSION_SO, version);
		versioned_scheduler_main =
			load_external_function(soname, BGW_DB_SCHEDULER_FUNCNAME, false, NULL);

            

Reported by FlawFinder.

tsl/test/src/remote/remote_exec.c
7 issues
Memory pointed to by 'result_text' is freed twice.
Error

Line: 100 CWE codes: 415

              		elog(elevel, "[%s]:\n%.*s", server_name, (int) result_text_size, result_text);

	if (result_text != NULL)
		free(result_text);
}

static void
set_connection_settings(TSConnection *conn)
{

            

Reported by Cppcheck.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 43 Column: 7 CWE codes: 377

              print_result(int elevel, const char *server_name, const PGresult *pg_result)
{
	FILE *result_stream;
	File tmpfile;
	char *result_text = NULL;
	size_t result_text_size = 0;
	PQprintOpt print_opt = {
		.header = 1,
		.align = 1,

            

Reported by FlawFinder.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 63 Column: 44 CWE codes: 377

              	tmpfile = OpenTemporaryFile(false);

	/* Open a stream to the same file for writing */
	result_stream = AllocateFile(FilePathName(tmpfile), "wb");

	if (!result_stream)
		elog(ERROR, "could not open message stream for remote_exec");

	/* Print the result to the file stream */

            

Reported by FlawFinder.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 75 Column: 30 CWE codes: 377

              	FreeFile(result_stream);

	/* Get the size of the written result */
	result_text_size = FileSize(tmpfile);

	/* Read the result into a memory buffer */
	if (result_text_size > 0)
	{
		int nread;

            

Reported by FlawFinder.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 84 Column: 20 CWE codes: 377

              
		result_text = malloc(result_text_size);

		nread = FileRead(tmpfile, result_text, result_text_size, 0, 0);
		if (nread != result_text_size)
		{
			free(result_text);
			FileClose(tmpfile);


            

Reported by FlawFinder.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 88 Column: 14 CWE codes: 377

              		if (nread != result_text_size)
		{
			free(result_text);
			FileClose(tmpfile);

			elog(ERROR, "unexpected number of bytes (%d) read by remote_exec", nread);
		}
	}


            

Reported by FlawFinder.

tmpfile - Function tmpfile() has a security flaw on some systems (e.g., older System V systems)
Security

Line: 94 Column: 12 CWE codes: 377

              		}
	}

	FileClose(tmpfile);

	if (result_text_size > 0)
		elog(elevel, "[%s]:\n%.*s", server_name, (int) result_text_size, result_text);

	if (result_text != NULL)

            

Reported by FlawFinder.

tsl/src/compression/datum_serialize.c
6 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 190 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			/* no alignment for short varlenas */
			data_length = VARSIZE_SHORT(val);
			check_allowed_data_len(data_length, *max_size);
			memcpy(ptr, val, data_length);
		}
		else if (TYPE_IS_PACKABLE(serializer->type_len, serializer->type_storage) &&
				 VARATT_CAN_MAKE_SHORT(val))
		{
			/* convert to short varlena -- no alignment */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 199 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			data_length = VARATT_CONVERTED_SHORT_SIZE(val);
			check_allowed_data_len(data_length, *max_size);
			SET_VARSIZE_SHORT(ptr, data_length);
			memcpy(ptr + 1, VARDATA(val), data_length - 1);
		}
		else
		{
			/* full 4-byte header varlena */
			ptr = align_and_zero(ptr, serializer->type_align, max_size);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 207 Column: 4 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			ptr = align_and_zero(ptr, serializer->type_align, max_size);
			data_length = VARSIZE(val);
			check_allowed_data_len(data_length, *max_size);
			memcpy(ptr, val, data_length);
		}
	}
	else if (serializer->type_len == -2)
	{
		/* cstring ... never needs alignment */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 216 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		Assert(serializer->type_align == 'c');
		data_length = strlen(DatumGetCString(datum)) + 1;
		check_allowed_data_len(data_length, *max_size);
		memcpy(ptr, DatumGetPointer(datum), data_length);
	}
	else
	{
		/* fixed-length pass-by-reference */
		ptr = align_and_zero(ptr, serializer->type_align, max_size);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 225 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		Assert(serializer->type_len > 0);
		data_length = serializer->type_len;
		check_allowed_data_len(data_length, *max_size);
		memcpy(ptr, DatumGetPointer(datum), data_length);
	}

	ptr += data_length;
	*max_size = *max_size - data_length;


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 214 Column: 17 CWE codes: 126

              	{
		/* cstring ... never needs alignment */
		Assert(serializer->type_align == 'c');
		data_length = strlen(DatumGetCString(datum)) + 1;
		check_allowed_data_len(data_length, *max_size);
		memcpy(ptr, DatumGetPointer(datum), data_length);
	}
	else
	{

            

Reported by FlawFinder.

tsl/test/sql/include/compression_test_hypertable.sql
6 issues
Syntax error at or near "\"
Syntax error

Line: 5 Column: 1

              -- Please see the included NOTICE for copyright information and
-- LICENSE-TIMESCALE for a copy of the license.

\set ECHO errors

DROP TABLE IF EXISTS original_result;


CREATE TABLE original_result AS :QUERY;

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 18 Column: 1

              WHERE hypertable.table_name like :'HYPERTABLE_NAME' and chunk.compressed_chunk_id IS NULL;

--dump & restore while data is in compressed state.
\c postgres :ROLE_SUPERUSER
SET client_min_messages = ERROR;
\! utils/pg_dump_aux_dump.sh dump/pg_dump.sql

\c :TEST_DBNAME
SET client_min_messages = ERROR;

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 20 Column: 1

              --dump & restore while data is in compressed state.
\c postgres :ROLE_SUPERUSER
SET client_min_messages = ERROR;
\! utils/pg_dump_aux_dump.sh dump/pg_dump.sql

\c :TEST_DBNAME
SET client_min_messages = ERROR;
CREATE EXTENSION timescaledb CASCADE;
RESET client_min_messages;

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 29 Column: 1

              
--\! cp dump/pg_dump.sql /tmp/dump.sql
SELECT timescaledb_pre_restore();
\! utils/pg_dump_aux_restore.sh dump/pg_dump.sql
SELECT timescaledb_post_restore();
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

with original AS (
  SELECT row_number() OVER() row_number, * FROM original_result

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 31 Column: 1

              SELECT timescaledb_pre_restore();
\! utils/pg_dump_aux_restore.sh dump/pg_dump.sql
SELECT timescaledb_post_restore();
\c :TEST_DBNAME :ROLE_DEFAULT_PERM_USER

with original AS (
  SELECT row_number() OVER() row_number, * FROM original_result
),
decompressed AS (

            

Reported by SQLint.

Syntax error at or near "\"
Syntax error

Line: 62 Column: 1

              FULL OUTER JOIN uncompressed ON (original.row_number = uncompressed.row_number)
WHERE (original.*) IS DISTINCT FROM (uncompressed.*);

\set ECHO all

            

Reported by SQLint.

src/dimension.c
6 issues
memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 171 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	d->fd.aligned = DatumGetBool(values[AttrNumberGetAttrOffset(Anum_dimension_aligned)]);
	d->fd.column_type =
		DatumGetObjectId(values[AttrNumberGetAttrOffset(Anum_dimension_column_type)]);
	memcpy(&d->fd.column_name,
		   DatumGetName(values[AttrNumberGetAttrOffset(Anum_dimension_column_name)]),
		   NAMEDATALEN);

	if (!isnull[Anum_dimension_partitioning_func_schema - 1] &&
		!isnull[Anum_dimension_partitioning_func - 1])

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 183 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		d->fd.num_slices =
			DatumGetInt16(values[AttrNumberGetAttrOffset(Anum_dimension_num_slices)]);

		memcpy(&d->fd.partitioning_func_schema,
			   DatumGetName(
				   values[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func_schema)]),
			   NAMEDATALEN);
		memcpy(&d->fd.partitioning_func,
			   DatumGetName(values[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func)]),

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 187 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              			   DatumGetName(
				   values[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func_schema)]),
			   NAMEDATALEN);
		memcpy(&d->fd.partitioning_func,
			   DatumGetName(values[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func)]),
			   NAMEDATALEN);

		old = MemoryContextSwitchTo(ti->mctx);
		d->partitioning = ts_partitioning_info_create(NameStr(d->fd.partitioning_func_schema),

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1603 Column: 34 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
		if (namestrcmp(schemaname, names[0]) == 0)
		{
			namestrcpy(schemaname, (const char *) names[1]);
			values[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func_schema)] =
				NameGetDatum(schemaname);
			doReplace[AttrNumberGetAttrOffset(Anum_dimension_partitioning_func_schema)] = true;
		}
	}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1616 Column: 34 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              			DatumGetName(values[AttrNumberGetAttrOffset(Anum_dimension_integer_now_func_schema)]);
		if (namestrcmp(schemaname, names[0]) == 0)
		{
			namestrcpy(schemaname, (const char *) names[1]);
			values[AttrNumberGetAttrOffset(Anum_dimension_integer_now_func_schema)] =
				NameGetDatum(schemaname);
			doReplace[AttrNumberGetAttrOffset(Anum_dimension_integer_now_func_schema)] = true;
		}
	}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1640 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	NameData old_schema_name;
	ScanKeyData scankey[1];
	Catalog *catalog = ts_catalog_get();
	char *names[2] = { (char *) old_name, (char *) new_name };
	ScannerCtx scanctx = {
		.table = catalog_get_table_id(catalog, DIMENSION),
		.index = InvalidOid,
		.nkeys = 1,
		.scankey = scankey,

            

Reported by FlawFinder.