BUG #17788: Incorrect memory access when parsing empty string as sql_standard interval
The Post Office <noreply@postgresql.org>
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: exclusion@gmail.com
Date: 2023-02-12T10:00:01Z
Lists: pgsql-bugs
The following bug has been logged on the website: Bug reference: 17788 Logged by: Alexander Lakhin Email address: exclusion@gmail.com PostgreSQL version: 15.2 Operating system: Ubuntu 22.04 Description: When executing under valgrind: SET IntervalStyle TO sql_standard; SELECT ''::interval; The following error is detected: ==00:00:00:03.574 1155861== Use of uninitialised value of size 8 ==00:00:00:03.574 1155861== at 0x606ADE: DecodeInterval (datetime.c:3368) ==00:00:00:03.574 1155861== by 0x6C4B79: interval_in (timestamp.c:915) ==00:00:00:03.574 1155861== by 0x718ED0: InputFunctionCall (fmgr.c:1532) ==00:00:00:03.574 1155861== by 0x719133: OidInputFunctionCall (fmgr.c:1635) ==00:00:00:03.574 1155861== by 0x34F0CD: stringTypeDatum (parse_type.c:662) ==00:00:00:03.574 1155861== by 0x333F66: coerce_type (parse_coerce.c:311) ==00:00:00:03.574 1155861== by 0x33322B: coerce_to_target_type (parse_coerce.c:104) ==00:00:00:03.574 1155861== by 0x33A8B8: transformTypeCast (parse_expr.c:2651) ==00:00:00:03.574 1155861== by 0x339E72: transformExprRecurse (parse_expr.c:146) ==00:00:00:03.574 1155861== by 0x339C32: transformExpr (parse_expr.c:104) ==00:00:00:03.574 1155861== by 0x34DAB0: transformTargetEntry (parse_target.c:95) ==00:00:00:03.574 1155861== by 0x34DB5F: transformTargetList (parse_target.c:183) ==00:00:00:03.574 1155861== ... ==00:00:00:03.574 1155861== ==00:00:00:03.574 1155861== Exit program on first error (--exit-on-first-error=yes) 2023-02-12 10:32:40.739 MSK|||63e89615.11a2c9|LOG: server process (PID 1155861) exited with exit code 1 2023-02-12 10:32:40.739 MSK|||63e89615.11a2c9|DETAIL: Failed process was running: SELECT ''::interval; This defect was introduced by the commit e39f9904. Before that commit the check if (IntervalStyle == INTSTYLE_SQL_STANDARD && *field[0] == '-') was guarded by if (fmask == 0) return DTERR_BAD_FORMAT; but now field[0] is accessed unconditionally (even when nf == 0) for the SQL_STANDARD style.
Commits
-
Avoid dereferencing an undefined pointer in DecodeInterval().
- 5e80d3515488 16.0 landed
- 0ef65d0f55e5 15.3 landed
-
Fix overflow hazards in interval input and output conversions.
- e39f99046710 15.0 cited