NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit611e110

committed

to_char(): prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memorybeyond the existing buffer allocated to hold the result.Reported by Andres Freund and Peter Geoghegan.Backpatch to allsupported versions.Security:CVE-2015-0241

1 parent5828f7c commit611e110Copy full SHA for 611e110

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- formatting.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/formatting.c`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4187,7 +4187,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)`
`4187`	`4187`	`Np->num_in= TRUE;`
`4188`	`4188`	`}`
`4189`	`4189`	`}`
`4190`		`-++Np->number_p;`
	`4190`	`+/* do no exceed string length */`
	`4191`	`+if (*Np->number_p)`
	`4192`	`+++Np->number_p;`
`4191`	`4193`	`}`
`4192`	`4194`
`4193`	`4195`	`end=Np->num_count+ (Np->out_pre_spaces ?1 :0)+ (IS_DECIMAL(Np->Num) ?1 :0);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit611e110

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/formatting.c`

0 commit comments