BUG #17277: write past chunk when calling normalize() on an empty string
The Post Office <noreply@postgresql.org>
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: postgresql@zr40.nl
Date: 2021-11-09T21:55:08Z
Lists: pgsql-bugs
The following bug has been logged on the website:
Bug reference: 17277
Logged by: Matthijs van der Vleuten
Email address: postgresql@zr40.nl
PostgreSQL version: 14.0
Operating system: Debian sid
Description:
When calling normalize(''), that is, on an empty string, a warning is
raised: "problem in alloc set ExprContext: detected write past chunk end".
I believe this is due to an error in unicode_norm.c. In unicode_normalize(),
when recompose is true (that is, when using NFC or NFKC normalization) the
loop on line 498 will iterate once before checking count < decomp_size. When
the input is an empty string, this would cause a write outside of the memory
allocated for recomp_chars.
Reproduction:
zr40@[local]:5432 ~=# select version();
version
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
PostgreSQL 14.0 (Debian 14.0-1.pgdg+1) on x86_64-pc-linux-gnu, compiled by
gcc (Debian 10.3.0-11) 10.3.0, 64-bit
(1 row)
zr40@[local]:5432 ~=# select normalize('');
WARNING: problem in alloc set ExprContext: detected write past chunk end in
block 0x55793d119620, chunk 0x55793d1196a8
WARNING: problem in alloc set ExprContext: detected write past chunk end in
block 0x55793d119620, chunk 0x55793d1196a8
normalize
───────────
(1 row)
Commits
-
Fix buffer overrun in unicode string normalization with empty input
- 7653f6f5f53f 10.20 landed
- 56c5a069e04b 11.15 landed
- de343812b97a 12.10 landed
- 13c8adf90e9d 13.6 landed
- b609db7155d9 14.2 landed
- 098c13455666 15.0 landed