From: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: ecpg: Fix out-of-bound read in DecodeDateTime()
Date: Tue, 22 Oct 2024 23:35:51 +0000
Message-ID: <E1t3OPn-001ySn-QP@gemulon.postgresql.org> (raw)
ecpg: Fix out-of-bound read in DecodeDateTime()
It was possible for the code to read out-of-bound data from the
"day_tab" table with some crafted input data. Let's treat these as
invalid input as the month number is incorrect.
A test is added to test this case with a check on the errno returned by
the decoding routine. A test close to the new one added in this commit
was testing for a failure, but did not look at the errno generated, so
let's use this commit to also change it, adding a check on the errno
returned by DecodeDateTime().
Like the other test scripts, dt_test should likely be expanded to
include more checks based on the errnos generated in these code paths.
This is left as future work.
This issue exists since 2e6f97560a83, so backpatch all the way down.
Reported-by: Pavel Nekrasov
Author: Bruce Momjian, Pavel Nekrasov
Discussion: https://postgr.es/m/18614-6bbe00117352309e@postgresql.org
Backpatch-through: 12
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/335501fb2b8007000d8c154628065355b5cd4366
Modified Files
--------------
src/interfaces/ecpg/pgtypeslib/dt_common.c | 6 +-
.../ecpg/test/expected/pgtypeslib-dt_test.c | 76 +++++++++++++++-------
.../ecpg/test/expected/pgtypeslib-dt_test.stderr | 42 ++++++------
.../ecpg/test/expected/pgtypeslib-dt_test.stdout | 3 +-
src/interfaces/ecpg/test/pgtypeslib/dt_test.pgc | 30 +++++++++
5 files changed, 109 insertions(+), 48 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: ecpg: Fix out-of-bound read in DecodeDateTime()
In-Reply-To: <E1t3OPn-001ySn-QP@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox