pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thiago Nunes <thiagotnunes@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template
Date: Tue, 14 Mar 2023 21:45:46 -0400
Message-ID: <3076956.1678844746@sss.pgh.pa.us> (raw)
In-Reply-To: <CANf6e1JxUFXpkH-ZV1u=bDL4vekZsqxeTcRtHVM-A8DZNxgqkw@mail.gmail.com>
References: <17839-aada50db24d7b0da@postgresql.org>
	<3011659.1678834145@sss.pgh.pa.us>
	<CANf6e1JxUFXpkH-ZV1u=bDL4vekZsqxeTcRtHVM-A8DZNxgqkw@mail.gmail.com>

Thiago Nunes <thiagotnunes@gmail.com> writes:
> I think your solution deals with all the cases, but I would like to point
> out how I fixed it locally. I recalculated Num.zero_end after this line (
> https://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/formatting.c#L6716
> ):

> ```
> Num.zero_end = Num.pre + Num.post;
> ```

Hmm ... that seems a bit ad-hoc, because as far as I understand this
code, zero_end is supposed to track where is the last '0' format
character.  That shouldn't change just because we decided that the
data value overflowed.

			regards, tom lane





view thread (5+ messages)  latest in thread

Message-ID: <3076956.1678844746@sss.pgh.pa.us>
Permalink:  ../3076956.1678844746@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/3076956.1678844746@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, thiagotnunes@gmail.com, pgsql-bugs@lists.postgresql.org
  Subject: Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template
  In-Reply-To: <3076956.1678844746@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox