agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix potential buffer overrun in regexp match/split functions.
Date: Mon, 10 Aug 2026 13:41:30 +0000
Message-ID: <E1wtQFu-00000000yIl-1cO9@gemulon.postgresql.org> (raw)
Fix potential buffer overrun in regexp match/split functions.
setup_regexp_matches() sizes the buffer used to convert matched
substrings back from pg_wchar form at the smaller of maxlen*eml and
the original string's byte length, on the assumption that such a
conversion cannot produce more bytes than the string it came
from. That assumption holds only for validly encoded input. But
pg_mb2wchar_with_len() silently accepts bytes that are invalid in the
database encoding, turning each such byte into one pg_wchar, and
converting that back can take more bytes than the input did. A string
made of such bytes therefore overruns the conversion buffer by up to
its own length, corrupting the following memory. regexp_match(),
regexp_matches(), regexp_split_to_table() and regexp_split_to_array()
are all affected.
Fix by dropping the tighter bound and always allocating maxlen*eml + 1
bytes.
Reported-by: Francesco Verardi <frevadiscor89@gmail.com>
Author: Masahiko Sawada <sawada.mshk@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Backpatch-through: 14
Security: CVE-2026-14664
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/127a0673f868ae743cc4d36fd6aecb1316fd3eb0
Author: Masahiko Sawada <msawada@postgresql.org>
Modified Files
--------------
src/backend/utils/adt/regexp.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
view thread (6+ messages)
Message-ID: <E1wtQFu-00000000yIl-1cO9@gemulon.postgresql.org>
Permalink: ../E1wtQFu-00000000yIl-1cO9@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFu-00000000yIl-1cO9@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix potential buffer overrun in regexp match/split functions.
In-Reply-To: <E1wtQFu-00000000yIl-1cO9@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox