NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit037529a

committed

to_char(): prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memorybeyond the existing buffer allocated to hold the result.Reported by Andres Freund and Peter Geoghegan.Backpatch to allsupported versions.Security:CVE-2015-0241

1 parent544cf24 commit037529aCopy full SHA for 037529a

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- formatting.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/formatting.c`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4390,7 +4390,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)`
`4390`	`4390`	`Np->num_in= TRUE;`
`4391`	`4391`	`}`
`4392`	`4392`	`}`
`4393`		`-++Np->number_p;`
	`4393`	`+/* do no exceed string length */`
	`4394`	`+if (*Np->number_p)`
	`4395`	`+++Np->number_p;`
`4394`	`4396`	`}`
`4395`	`4397`
`4396`	`4398`	`end=Np->num_count+ (Np->out_pre_spaces ?1 :0)+ (IS_DECIMAL(Np->Num) ?1 :0);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit037529a

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/formatting.c`

0 commit comments