postgres-github.git / summary / log / commit / refs

commit    6a985e71e9213420b5ebd388b20b2d3180ce0468
Author:   Nathan Bossart <nathan@postgresql.org>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon May 11 12:13:47 2026 +0000

    Avoid overflow in size calculations in formatting.c.
    
    A few functions in this file were incautious about multiplying a
    possibly large integer by a factor more than 1 and then using it as
    an allocation size.  This is harmless on 64-bit systems where we'd
    compute a size exceeding MaxAllocSize and then fail, but on 32-bit
    systems we could overflow size_t, leading to an undersized
    allocation and buffer overrun.  To fix, use palloc_array() or
    mul_size() instead of handwritten multiplication.
    
    Reported-by: Sven Klemm <sven@tigerdata.com>
    Reported-by: Xint Code
    Author: Nathan Bossart <nathandbossart@gmail.com>
    Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Tatsuo Ishii <ishii@postgresql.org>
    Security: CVE-2026-6473
    Backpatch-through: 14

[parent: 4793fc41f828]