MIME-Version: 1.0
References: <17839-aada50db24d7b0da@postgresql.org>
 <3011659.1678834145@sss.pgh.pa.us>
 <CANf6e1JxUFXpkH-ZV1u=bDL4vekZsqxeTcRtHVM-A8DZNxgqkw@mail.gmail.com>
 <3076956.1678844746@sss.pgh.pa.us>
In-Reply-To: <3076956.1678844746@sss.pgh.pa.us>
From: Thiago Nunes <thiagotnunes@gmail.com>
Date: Wed, 15 Mar 2023 13:02:37 +1100
Message-ID: 
 <CANf6e1+LSX4EMER08f2rSQ+MSMUzAtVfKXFpiBRAdRmk2L-uQQ@mail.gmail.com>
Subject: Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid
 template
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000b268af05f6e6bd1e"
Archived-At: 
 <https://www.postgresql.org/message-id/CANf6e1%2BLSX4EMER08f2rSQ%2BMSMUzAtVfKXFpiBRAdRmk2L-uQQ%40mail.gmail.com>
Precedence: bulk

--000000000000b268af05f6e6bd1e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Got it, I thought that since we were filling the string with #s there, we
should reposition the zero_end.

I will wait for your patch then, thanks for looking into it!

Cheers,

On Wed, Mar 15, 2023 at 12:45=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote=
:

> Thiago Nunes <thiagotnunes@gmail.com> writes:
> > I think your solution deals with all the cases, but I would like to poi=
nt
> > out how I fixed it locally. I recalculated Num.zero_end after this line=
 (
> >
> https://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/=
formatting.c#L6716
> > ):
>
> > ```
> > Num.zero_end =3D Num.pre + Num.post;
> > ```
>
> Hmm ... that seems a bit ad-hoc, because as far as I understand this
> code, zero_end is supposed to track where is the last '0' format
> character.  That shouldn't change just because we decided that the
> data value overflowed.
>
>                         regards, tom lane
>

--000000000000b268af05f6e6bd1e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Got it, I thought that since we were filling the string wi=
th #s there, we should reposition the zero_end.<div><br></div><div>I will w=
ait for your patch then, thanks for looking into it!</div><div><br></div><d=
iv>Cheers,</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=
=3D"gmail_attr">On Wed, Mar 15, 2023 at 12:45=E2=80=AFPM Tom Lane &lt;<a hr=
ef=3D"mailto:tgl@sss.pgh.pa.us">tgl@sss.pgh.pa.us</a>&gt; wrote:<br></div><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex">Thiago Nunes &lt;<a href=
=3D"mailto:thiagotnunes@gmail.com" target=3D"_blank">thiagotnunes@gmail.com=
</a>&gt; writes:<br>
&gt; I think your solution deals with all the cases, but I would like to po=
int<br>
&gt; out how I fixed it locally. I recalculated Num.zero_end after this lin=
e (<br>
&gt; <a href=3D"https://github.com/postgres/postgres/blob/REL_15_2/src/back=
end/utils/adt/formatting.c#L6716" rel=3D"noreferrer" target=3D"_blank">http=
s://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/format=
ting.c#L6716</a><br>
&gt; ):<br>
<br>
&gt; ```<br>
&gt; Num.zero_end =3D Num.pre + Num.post;<br>
&gt; ```<br>
<br>
Hmm ... that seems a bit ad-hoc, because as far as I understand this<br>
code, zero_end is supposed to track where is the last &#39;0&#39; format<br=
>
character.=C2=A0 That shouldn&#39;t change just because we decided that the=
<br>
data value overflowed.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 regards, tom lane<br>
</blockquote></div>

--000000000000b268af05f6e6bd1e--