Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita67c75f

Browse files
committed
Fix corner case bug in numeric to_char() some more.
The band-aid applied in commitf0bedf3 turns out to still needsome work: it made sure we didn't set Np->last_relevant too small(to the left of the decimal point), but it didn't prevent settingit too large (off the end of the partially-converted string).This could result in fetching data beyond the end of the allocatedspace, which with very bad luck could cause a SIGSEGV, thoughI don't see any hazard of interesting memory disclosure.Per bug #17839 from Thiago Nunes. The bug's pretty ancient,so back-patch to all supported versions.Discussion:https://postgr.es/m/17839-aada50db24d7b0da@postgresql.org
1 parent3b45944 commita67c75f

File tree

3 files changed

+16
-2
lines changed

3 files changed

+16
-2
lines changed

‎src/backend/utils/adt/formatting.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5731,13 +5731,20 @@ NUM_processor(FormatNode *node, NUMDesc *Num, char *inout,
57315731

57325732
/*
57335733
* If any '0' specifiers are present, make sure we don't strip
5734-
* those digits.
5734+
* those digits. But don't advance last_relevant beyond the last
5735+
* character of the Np->number string, which is a hazard if the
5736+
* number got shortened due to precision limitations.
57355737
*/
57365738
if (Np->last_relevant&&Np->Num->zero_end>Np->out_pre_spaces)
57375739
{
5740+
intlast_zero_pos;
57385741
char*last_zero;
57395742

5740-
last_zero=Np->number+ (Np->Num->zero_end-Np->out_pre_spaces);
5743+
/* note that Np->number cannot be zero-length here */
5744+
last_zero_pos=strlen(Np->number)-1;
5745+
last_zero_pos=Min(last_zero_pos,
5746+
Np->Num->zero_end-Np->out_pre_spaces);
5747+
last_zero=Np->number+last_zero_pos;
57415748
if (Np->last_relevant<last_zero)
57425749
Np->last_relevant=last_zero;
57435750
}

‎src/test/regress/expected/numeric.out

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1929,6 +1929,12 @@ SELECT to_char('100'::numeric, 'FM999');
19291929
100
19301930
(1 row)
19311931

1932+
SELECT to_char('12345678901'::float8, 'FM9999999999D9999900000000000000000');
1933+
to_char
1934+
-----------------
1935+
##########.####
1936+
(1 row)
1937+
19321938
-- Check parsing of literal text in a format string
19331939
SELECT to_char('100'::numeric, 'foo999');
19341940
to_char

‎src/test/regress/sql/numeric.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -979,6 +979,7 @@ FROM v;
979979
SELECT to_char('100'::numeric,'FM999.9');
980980
SELECT to_char('100'::numeric,'FM999.');
981981
SELECT to_char('100'::numeric,'FM999');
982+
SELECT to_char('12345678901'::float8,'FM9999999999D9999900000000000000000');
982983

983984
-- Check parsing of literal text in a format string
984985
SELECT to_char('100'::numeric,'foo999');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp