Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7cac191

Browse files
committed
Fix corner case bug in numeric to_char() some more.
The band-aid applied in commitf0bedf3 turns out to still needsome work: it made sure we didn't set Np->last_relevant too small(to the left of the decimal point), but it didn't prevent settingit too large (off the end of the partially-converted string).This could result in fetching data beyond the end of the allocatedspace, which with very bad luck could cause a SIGSEGV, thoughI don't see any hazard of interesting memory disclosure.Per bug #17839 from Thiago Nunes. The bug's pretty ancient,so back-patch to all supported versions.Discussion:https://postgr.es/m/17839-aada50db24d7b0da@postgresql.org
1 parent7c509f7 commit7cac191

File tree

3 files changed

+16
-2
lines changed

3 files changed

+16
-2
lines changed

‎src/backend/utils/adt/formatting.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5684,13 +5684,20 @@ NUM_processor(FormatNode *node, NUMDesc *Num, char *inout,
56845684

56855685
/*
56865686
* If any '0' specifiers are present, make sure we don't strip
5687-
* those digits.
5687+
* those digits. But don't advance last_relevant beyond the last
5688+
* character of the Np->number string, which is a hazard if the
5689+
* number got shortened due to precision limitations.
56885690
*/
56895691
if (Np->last_relevant&&Np->Num->zero_end>Np->out_pre_spaces)
56905692
{
5693+
intlast_zero_pos;
56915694
char*last_zero;
56925695

5693-
last_zero=Np->number+ (Np->Num->zero_end-Np->out_pre_spaces);
5696+
/* note that Np->number cannot be zero-length here */
5697+
last_zero_pos=strlen(Np->number)-1;
5698+
last_zero_pos=Min(last_zero_pos,
5699+
Np->Num->zero_end-Np->out_pre_spaces);
5700+
last_zero=Np->number+last_zero_pos;
56945701
if (Np->last_relevant<last_zero)
56955702
Np->last_relevant=last_zero;
56965703
}

‎src/test/regress/expected/numeric.out‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1929,6 +1929,12 @@ SELECT to_char('100'::numeric, 'FM999');
19291929
100
19301930
(1 row)
19311931

1932+
SELECT to_char('12345678901'::float8, 'FM9999999999D9999900000000000000000');
1933+
to_char
1934+
-----------------
1935+
##########.####
1936+
(1 row)
1937+
19321938
-- Check parsing of literal text in a format string
19331939
SELECT to_char('100'::numeric, 'foo999');
19341940
to_char

‎src/test/regress/sql/numeric.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -979,6 +979,7 @@ FROM v;
979979
SELECT to_char('100'::numeric,'FM999.9');
980980
SELECT to_char('100'::numeric,'FM999.');
981981
SELECT to_char('100'::numeric,'FM999');
982+
SELECT to_char('12345678901'::float8,'FM9999999999D9999900000000000000000');
982983

983984
-- Check parsing of literal text in a format string
984985
SELECT to_char('100'::numeric,'foo999');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp