NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commit0150ab5

committed

to_char(): prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memorybeyond the existing buffer allocated to hold the result.Reported by Andres Freund and Peter Geoghegan.Backpatch to allsupported versions.Security:CVE-2015-0241

1 parentf9ee8ea commit0150ab5Copy full SHA for 0150ab5

File tree

1 file changed

-1

lines changed

src/backend/utils/adt
- formatting.c

1 file changed

-1

lines changed

`‎src/backend/utils/adt/formatting.c`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4428,7 +4428,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)`
`4428`	`4428`	`Np->num_in= TRUE;`
`4429`	`4429`	`}`
`4430`	`4430`	`}`
`4431`		`-++Np->number_p;`
	`4431`	`+/* do no exceed string length */`
	`4432`	`+if (*Np->number_p)`
	`4433`	`+++Np->number_p;`
`4432`	`4434`	`}`
`4433`	`4435`
`4434`	`4436`	`end=Np->num_count+ (Np->out_pre_spaces ?1 :0)+ (IS_DECIMAL(Np->Num) ?1 :0);`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit0150ab5

File tree

1 file changed

1 file changed

`‎src/backend/utils/adt/formatting.c`

0 commit comments