upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-03-27 21:03:14 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

to_char(): prevent accesses beyond the allocated buffer

Browse source 
Previously very long field masks for floats could access memory
beyond the existing buffer allocated to hold the result.

Reported by Andres Freund and Peter Geoghegan.	Backpatch to all
supported versions.

Security: CVE-2015-0241
This commit is contained in:
Bruce Momjian 2015-02-02 10:00:44 -05:00
parent e87dedc0c4
commit 1628a0bbfa
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/backend/utils/adt/formatting.c
View file

@ -4428,7 +4428,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)
Np->num_in = TRUE;
}
}
++Np->number_p;
/* do no exceed string length */
if (*Np->number_p)
++Np->number_p;
}
end = Np->num_count + (Np->out_pre_spaces ? 1 : 0) + (IS_DECIMAL(Np->Num) ? 1 : 0);