From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robins Tharakan <tharakan@gmail.com>
Cc: John Naylor <john.naylor@enterprisedb.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17725: Sefault when seg_in() called with a large argument
Date: Tue, 20 Dec 2022 12:06:31 -0500
Message-ID: <1181726.1671555991@sss.pgh.pa.us> (raw)
In-Reply-To: <1180064.1671555286@sss.pgh.pa.us>
References: <17725-0a09313b67fbe86e@postgresql.org>
<CAFBsxsEn0HgkvmX4J3mipZn_gdoF19dj8g-q9WdS76G4QO2cYA@mail.gmail.com>
<CAEP4nAyECwMeeuzLW=RL4XHwCgxiQgMnfnG4ky-LP1LN82kKaw@mail.gmail.com>
<1180064.1671555286@sss.pgh.pa.us>
I wrote:
> I don't see a crash either, but I can't help observing that this
> input leads to a "seg" struct with "-46" significant digits:
> ...
> So we're invoking sprintf with a fairly insane precision spec:
Actually, it looks like sprintf is not the problem. This is:
(gdb)
984 buf[10 + n] = '\0';
(gdb) p n
$9 = -46
So first off, we're stomping on something we shouldn't, and
secondly we're failing to nul-terminate buf[], which easily
explains your observed crash at the strcpy a little further
down. On most platforms strcpy would find a nul byte not
too much further on, which might prevent the worst sorts
of damage, but this is still very ugly.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, tharakan@gmail.com, john.naylor@enterprisedb.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17725: Sefault when seg_in() called with a large argument
In-Reply-To: <1181726.1671555991@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox