postgres.git / summary / log / commit / refs

commit    de90bb7db1f8c7ab1289f82f877a6e18f7b3d468
Author:   Jeff Davis <jdavis@postgresql.org>
Date:     Thu Jan 29 18:14:55 2026 +0000
First released in: 18.2

    Fix theoretical memory leaks in pg_locale_libc.c.
    
    The leaks were hard to reach in practice and the impact was low.
    
    The callers provide a buffer the same number of bytes as the source
    string (plus one for NUL terminator) as a starting size, and libc
    never increases the number of characters. But, if the byte length of
    one of the converted characters is larger, then it might need a larger
    destination buffer. Previously, in that case, the working buffers
    would be leaked.
    
    Even in that case, the call typically happens within a context that
    will soon be reset. Regardless, it's worth fixing to avoid such
    assumptions, and the fix is simple so it's worth backporting.
    
    Discussion: https://postgr.es/m/e2b7a0a88aaadded7e2d19f42d5ab03c9e182ad8.camel@j-davis.com
    Backpatch-through: 18


 src/backend/utils/adt/pg_locale_libc.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/backend/utils/adt/pg_locale_libc.c b/src/backend/utils/adt/pg_locale_libc.c
index 2f96e889595..78f6ea161a0 100644
--- a/src/backend/utils/adt/pg_locale_libc.c
+++ b/src/backend/utils/adt/pg_locale_libc.c
@@ -527,11 +527,11 @@ strlower_libc_mb(char *dest, size_t destsize, const char *src, ssize_t srclen,
 
 	result_size = wchar2char(result, workspace, max_size + 1, loc);
 
-	if (result_size + 1 > destsize)
-		return result_size;
-
-	memcpy(dest, result, result_size);
-	dest[result_size] = '\0';
+	if (destsize >= result_size + 1)
+	{
+		memcpy(dest, result, result_size);
+		dest[result_size] = '\0';
+	}
 
 	pfree(workspace);
 	pfree(result);
@@ -638,11 +638,11 @@ strtitle_libc_mb(char *dest, size_t destsize, const char *src, ssize_t srclen,
 
 	result_size = wchar2char(result, workspace, max_size + 1, loc);
 
-	if (result_size + 1 > destsize)
-		return result_size;
-
-	memcpy(dest, result, result_size);
-	dest[result_size] = '\0';
+	if (destsize >= result_size + 1)
+	{
+		memcpy(dest, result, result_size);
+		dest[result_size] = '\0';
+	}
 
 	pfree(workspace);
 	pfree(result);
@@ -725,11 +725,11 @@ strupper_libc_mb(char *dest, size_t destsize, const char *src, ssize_t srclen,
 
 	result_size = wchar2char(result, workspace, max_size + 1, loc);
 
-	if (result_size + 1 > destsize)
-		return result_size;
-
-	memcpy(dest, result, result_size);
-	dest[result_size] = '\0';
+	if (destsize >= result_size + 1)
+	{
+		memcpy(dest, result, result_size);
+		dest[result_size] = '\0';
+	}
 
 	pfree(workspace);
 	pfree(result);


[parent: ec3174407164]