postgres.git / summary / log / commit / refs

commit    d9a1e9de54747354073fdc3e9bfb45258533da4c
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Tue Oct 07 01:23:20 2014 +0000
First released in: 9.5.0, 9.0.19, 9.1.15, 9.2.10, 9.3.6, 9.4.0

    Fix array overrun in ecpg's version of ParseDateTime().
    
    The code wrote a value into the caller's field[] array before checking
    to see if there was room, which of course is backwards.  Per report from
    Michael Paquier.
    
    I fixed the equivalent bug in the backend's version of this code way back
    in 630684d3a130bb93, but failed to think about ecpg's copy.  Fortunately
    this doesn't look like it would be exploitable for anything worse than a
    core dump: an external attacker would have no control over the single word
    that gets written.


 src/interfaces/ecpg/pgtypeslib/dt_common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/interfaces/ecpg/pgtypeslib/dt_common.c b/src/interfaces/ecpg/pgtypeslib/dt_common.c
index e89d3bb33d6..9abb7f71c84 100644
--- a/src/interfaces/ecpg/pgtypeslib/dt_common.c
+++ b/src/interfaces/ecpg/pgtypeslib/dt_common.c
@@ -1672,6 +1672,7 @@ DecodePosixTimezone(char *str, int *tzp)
  *
  * The "lowstr" work buffer must have at least strlen(timestr) + MAXDATEFIELDS
  * bytes of space.  On output, field[] entries will point into it.
+ * The field[] and ftype[] arrays must have at least MAXDATEFIELDS entries.
  */
 int
 ParseDateTime(char *timestr, char *lowstr,
@@ -1685,9 +1686,9 @@ ParseDateTime(char *timestr, char *lowstr,
 	while (*(*endstr) != '\0')
 	{
 		/* Record start of current field */
-		field[nf] = lp;
 		if (nf >= MAXDATEFIELDS)
 			return -1;
+		field[nf] = lp;
 
 		/* leading digit? then date or time */
 		if (isdigit((unsigned char) *(*endstr)))


[parent: 64a628576700]