Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit386a260

Browse files
committed
Fix corner case bug in numeric to_char() some more.
The band-aid applied in commitf0bedf3 turns out to still needsome work: it made sure we didn't set Np->last_relevant too small(to the left of the decimal point), but it didn't prevent settingit too large (off the end of the partially-converted string).This could result in fetching data beyond the end of the allocatedspace, which with very bad luck could cause a SIGSEGV, thoughI don't see any hazard of interesting memory disclosure.Per bug #17839 from Thiago Nunes. The bug's pretty ancient,so back-patch to all supported versions.Discussion:https://postgr.es/m/17839-aada50db24d7b0da@postgresql.org
1 parent52e9a78 commit386a260

File tree

3 files changed

+16
-2
lines changed

3 files changed

+16
-2
lines changed

‎src/backend/utils/adt/formatting.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5685,13 +5685,20 @@ NUM_processor(FormatNode *node, NUMDesc *Num, char *inout,
56855685

56865686
/*
56875687
* If any '0' specifiers are present, make sure we don't strip
5688-
* those digits.
5688+
* those digits. But don't advance last_relevant beyond the last
5689+
* character of the Np->number string, which is a hazard if the
5690+
* number got shortened due to precision limitations.
56895691
*/
56905692
if (Np->last_relevant&&Np->Num->zero_end>Np->out_pre_spaces)
56915693
{
5694+
intlast_zero_pos;
56925695
char*last_zero;
56935696

5694-
last_zero=Np->number+ (Np->Num->zero_end-Np->out_pre_spaces);
5697+
/* note that Np->number cannot be zero-length here */
5698+
last_zero_pos=strlen(Np->number)-1;
5699+
last_zero_pos=Min(last_zero_pos,
5700+
Np->Num->zero_end-Np->out_pre_spaces);
5701+
last_zero=Np->number+last_zero_pos;
56955702
if (Np->last_relevant<last_zero)
56965703
Np->last_relevant=last_zero;
56975704
}

‎src/test/regress/expected/numeric.out

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1266,6 +1266,12 @@ SELECT '' AS to_char_26, to_char('100'::numeric, 'FM999');
12661266
| 100
12671267
(1 row)
12681268

1269+
SELECT to_char('12345678901'::float8, 'FM9999999999D9999900000000000000000');
1270+
to_char
1271+
-----------------
1272+
##########.####
1273+
(1 row)
1274+
12691275
-- Check parsing of literal text in a format string
12701276
SELECT '' AS to_char_27, to_char('100'::numeric, 'foo999');
12711277
to_char_27 | to_char

‎src/test/regress/sql/numeric.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -799,6 +799,7 @@ SELECT '' AS to_char_23, to_char(val, '9.999EEEE')FROM num_data;
799799
SELECT''AS to_char_24, to_char('100'::numeric,'FM999.9');
800800
SELECT''AS to_char_25, to_char('100'::numeric,'FM999.');
801801
SELECT''AS to_char_26, to_char('100'::numeric,'FM999');
802+
SELECT to_char('12345678901'::float8,'FM9999999999D9999900000000000000000');
802803

803804
-- Check parsing of literal text in a format string
804805
SELECT''AS to_char_27, to_char('100'::numeric,'foo999');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp