fix crash

Author: anju15bharti

contrib/babelfishpg_tsql/src/catalog.c

@@ -450,24 +450,63 @@ bbf_rewrite_truncated_identifiers(const char *msg)
 			found = strstr(search_msg, key);
 			while (found)
 			{
+				int prefix_len = found - search_msg;
+				int orig_len = strlen(entry->original_name);
+				int suffix_len = strlen(found + key_len);
+				char *newmsg = MemoryContextAlloc(TopMemoryContext,
+												  prefix_len + orig_len + suffix_len + 1);
+				char *oldresult = result;
+
+				memcpy(newmsg, search_msg, prefix_len);
+				memcpy(newmsg + prefix_len, entry->original_name, orig_len);
+				memcpy(newmsg + prefix_len + orig_len, found + key_len, suffix_len + 1);
+
+				if (oldresult)
+					pfree(oldresult);
+
+				result = newmsg;
+				search_msg = newmsg;
+				found = strstr(search_msg + prefix_len + orig_len, key);
+			}
+		}
+	}
+
+	/* Validate UTF-8 before returning — avoid crashing the TDS layer */
+	if (result)
+	{
+		const unsigned char *p = (const unsigned char *) result;
+		while (*p)
+		{
+			if (*p >= 0x80)
+			{
+				if ((*p & 0xE0) == 0xC0)
 				{
-					int prefix_len = found - search_msg;
-					int orig_len = strlen(entry->original_name);
-					int suffix_len = strlen(found + key_len);
-					char *newmsg = MemoryContextAlloc(TopMemoryContext,
-													  prefix_len + orig_len + suffix_len + 1);
-					memcpy(newmsg, search_msg, prefix_len);
-					memcpy(newmsg + prefix_len, entry->original_name, orig_len);
-					memcpy(newmsg + prefix_len + orig_len, found + key_len, suffix_len + 1);
-					search_msg = newmsg;
-					result = newmsg;
-					found = strstr(search_msg + prefix_len + orig_len, key);
+					if ((p[1] & 0xC0) != 0x80) goto invalid;
+					p += 2;
 				}
+				else if ((*p & 0xF0) == 0xE0)
+				{
+					if ((p[1] & 0xC0) != 0x80 || (p[2] & 0xC0) != 0x80) goto invalid;
+					p += 3;
+				}
+				else if ((*p & 0xF8) == 0xF0)
+				{
+					if ((p[1] & 0xC0) != 0x80 || (p[2] & 0xC0) != 0x80 || (p[3] & 0xC0) != 0x80) goto invalid;
+					p += 4;
+				}
+				else
+					goto invalid;
 			}
+			else
+				p++;
 		}
 	}
 
 	return result;
+
+invalid:
+	pfree(result);
+	return NULL;
 }
 
 PG_FUNCTION_INFO_V1(init_catalog);

contrib/babelfishpg_tsql/src/pl_handler.c

@@ -8726,35 +8726,18 @@ void pltsql_bbfSelectIntoUtility(ParseState *pstate, PlannedStmt *pstmt, const c
 			 */
 			Query *query = castNode(Query, ((CreateTableAsStmt *)parsetree)->query);
 			ListCell *tlc;
-			List *saved_resnames = NIL;
 
 			foreach(tlc, query->targetList)
 			{
 				TargetEntry *tle = (TargetEntry *) lfirst(tlc);
-				saved_resnames = lappend(saved_resnames, tle->resname);
 				if (tle->resname && strlen(tle->resname) >= NAMEDATALEN)
 				{
 					tle->resname = pstrdup(tle->resname);
 					truncate_identifier(tle->resname, strlen(tle->resname), false);
 				}
 			}
 
-			PG_TRY();
-			{
-				*address = ExecCreateTableAs(pstate, (CreateTableAsStmt *)parsetree, params, queryEnv, qc);
-			}
-			PG_FINALLY();
-			{
-				/* Restore original resnames to prevent UTF8 corruption in TDS response */
-				ListCell *slc = list_head(saved_resnames);
-				foreach(tlc, query->targetList)
-				{
-					TargetEntry *tle = (TargetEntry *) lfirst(tlc);
-					tle->resname = (char *) lfirst(slc);
-					slc = lnext(saved_resnames, slc);
-				}
-			}
-			PG_END_TRY();
+			*address = ExecCreateTableAs(pstate, (CreateTableAsStmt *)parsetree, params, queryEnv, qc);
 		}
 		else
 		{