upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-06-08 16:26:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

to_char(): prevent accesses beyond the allocated buffer

Browse source 
Previously very long field masks for floats could access memory
beyond the existing buffer allocated to hold the result.

Reported by Andres Freund and Peter Geoghegan.	Backpatch to all
supported versions.

Security: CVE-2015-0241
This commit is contained in:
Bruce Momjian 2015-02-02 10:00:44 -05:00
parent 544cf245bd
commit 037529a11c
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/backend/utils/adt/formatting.c
View file

@ -4390,7 +4390,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)
Np->num_in = TRUE;
}
}
++Np->number_p;
/* do no exceed string length */
if (*Np->number_p)
++Np->number_p;
}
end = Np->num_count + (Np->out_pre_spaces ? 1 : 0) + (IS_DECIMAL(Np->Num) ? 1 : 0);