public inbox for [email protected]
help / color / mirror / Atom feedFrom: Noah Misch <[email protected]>
To: [email protected]
Subject: pgsql: Fix integer-overflow and alignment hazards in locale-related cod
Date: Mon, 11 May 2026 12:19:40 +0000
Message-ID: <[email protected]> (raw)
Fix integer-overflow and alignment hazards in locale-related code.
pg_locale_icu.c was full of places where a very long input string
could cause integer overflow while calculating a buffer size,
leading to buffer overruns.
It also was cavalier about using char-type local arrays as buffers
holding arrays of UChar. The alignment of a char[] variable isn't
guaranteed, so that this risked failure on alignment-picky platforms.
The lack of complaints suggests that such platforms are very rare
nowadays; but it's likely that we are paying a performance price on
rather more platforms. Declare those arrays as UChar[] instead,
keeping their physical size the same.
pg_locale_libc.c's strncoll_libc_win32_utf8() also had the
disease of assuming it could double or quadruple the input
string length without concern for overflow.
Reported-by: Xint Code
Reported-by: Pavel Kohout <[email protected]>
Author: Tom Lane <[email protected]>
Backpatch-through: 14
Security: CVE-2026-6473
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/c259731242148834ac053dc3f6a4ffc3b317aa9a
Author: Tom Lane <[email protected]>
Modified Files
--------------
src/backend/utils/adt/pg_locale.c | 88 +++++++++++++++++++--------------------
1 file changed, 43 insertions(+), 45 deletions(-)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected]
Subject: Re: pgsql: Fix integer-overflow and alignment hazards in locale-related cod
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox