postgres-github.git / summary / log / commit / refs

commit    76ab76f875a85d51da91dca18d64a6b717533ad9
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon May 11 12:13:46 2026 +0000

    Avoid passing unintended format codes to snprintf().
    
    timeofday() assumed that the output of pg_strftime() could not contain
    % signs, other than the one it explicitly asks for with %%.  However,
    we don't have that guarantee with respect to the time zone name (%Z).
    A crafted time zone setting could abuse the subsequent snprintf()
    call, resulting in crashes or disclosure of server memory.
    
    To fix, split the pg_strftime() call into two and then treat the
    outputs as literal strings, not a snprintf format string.  The
    extra pg_strftime() call doesn't really cost anything, since the
    bulk of the conversion work was done by pg_localtime().
    
    Also, adjust buffer widths so that we're not risking string truncation
    during the snprintf() step, as that would create a hazard of producing
    mis-encoded output.
    
    This also fixes a latent portability issue: the format string expects
    an int, but tp.tv_usec is long int on many platforms.
    
    Reported-by: Xint Code
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: John Naylor <johncnaylorls@gmail.com>
    Backpatch-through: 14
    Security: CVE-2026-6474

[parent: 46b4f5c11b0f]