From: Thiago Nunes <thiagotnunes@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template
Date: Wed, 15 Mar 2023 13:02:37 +1100
Message-ID: <CANf6e1+LSX4EMER08f2rSQ+MSMUzAtVfKXFpiBRAdRmk2L-uQQ@mail.gmail.com> (raw)
In-Reply-To: <3076956.1678844746@sss.pgh.pa.us>
References: <17839-aada50db24d7b0da@postgresql.org>
<3011659.1678834145@sss.pgh.pa.us>
<CANf6e1JxUFXpkH-ZV1u=bDL4vekZsqxeTcRtHVM-A8DZNxgqkw@mail.gmail.com>
<3076956.1678844746@sss.pgh.pa.us>
Got it, I thought that since we were filling the string with #s there, we
should reposition the zero_end.
I will wait for your patch then, thanks for looking into it!
Cheers,
On Wed, Mar 15, 2023 at 12:45 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Thiago Nunes <thiagotnunes@gmail.com> writes:
> > I think your solution deals with all the cases, but I would like to point
> > out how I fixed it locally. I recalculated Num.zero_end after this line (
> >
> https://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/formatting.c#L6716
> > ):
>
> > ```
> > Num.zero_end = Num.pre + Num.post;
> > ```
>
> Hmm ... that seems a bit ad-hoc, because as far as I understand this
> code, zero_end is supposed to track where is the last '0' format
> character. That shouldn't change just because we decided that the
> data value overflowed.
>
> regards, tom lane
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: thiagotnunes@gmail.com, tgl@sss.pgh.pa.us, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template
In-Reply-To: <CANf6e1+LSX4EMER08f2rSQ+MSMUzAtVfKXFpiBRAdRmk2L-uQQ@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox