NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commitb8b5801

committed

to_char(): prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memorybeyond the existing buffer allocated to hold the result.Reported by Andres Freund and Peter Geoghegan.Backpatch to allsupported versions.Security:CVE-2015-0241

1 parentfa06ce5 commitb8b5801Copy full SHA for b8b5801

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- formatting.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/formatting.c‎`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4416,7 +4416,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)`
`4416`	`4416`	`Np->num_in= TRUE;`
`4417`	`4417`	`}`
`4418`	`4418`	`}`
`4419`		`-++Np->number_p;`
	`4419`	`+/* do no exceed string length */`
	`4420`	`+if (*Np->number_p)`
	`4421`	`+++Np->number_p;`
`4420`	`4422`	`}`
`4421`	`4423`
`4422`	`4424`	`end=Np->num_count+ (Np->out_pre_spaces ?1 :0)+ (IS_DECIMAL(Np->Num) ?1 :0);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitb8b5801

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/formatting.c‎`

0 commit comments