agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac 6+ messages / 1 participants [nested] [flat]
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/a16c31d39c8bc1ed979b1b778238e3e1e72a311f Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/80ce920a5a42a43d98ac40d174fea8ae518abf63 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/08e812c02ae14bbfb03d787884e4c6087419ecf7 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/849da82105395fa4d06f877db8edc62158167941 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/ac450853d5d0694a9071504d588dd60e28209198 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports. Reported-by: Hcamael <baiyjrh@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3b925133b54df3fc89bcec47c525b6a7386dcc88 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox