NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit5ae3bf1

committed

to_char(): prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memorybeyond the existing buffer allocated to hold the result.Reported by Andres Freund and Peter Geoghegan.Backpatch to allsupported versions.Security:CVE-2015-0241

1 parent611037d commit5ae3bf1Copy full SHA for 5ae3bf1

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- formatting.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/formatting.c`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4409,7 +4409,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)`
`4409`	`4409`	`Np->num_in= TRUE;`
`4410`	`4410`	`}`
`4411`	`4411`	`}`
`4412`		`-++Np->number_p;`
	`4412`	`+/* do no exceed string length */`
	`4413`	`+if (*Np->number_p)`
	`4414`	`+++Np->number_p;`
`4413`	`4415`	`}`
`4414`	`4416`
`4415`	`4417`	`end=Np->num_count+ (Np->out_pre_spaces ?1 :0)+ (IS_DECIMAL(Np->Num) ?1 :0);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit5ae3bf1

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/formatting.c`

0 commit comments