overflow in snprintf() when printing INT64_MIN

Andres Freund <andres@anarazel.de>

From: Andres Freund <andres@anarazel.de>
To: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Date: 2018-09-28T00:11:21Z
Lists: pgsql-hackers
Hi,

I just noticed, while reviewing a patch that corrects overflow handing
in snprintf, that we don't correctly handle INT64_MIN in snprintf.c:

static void
fmtint(int64 value, char type, int forcesign, int leftjust,
           int minlen, int zpad, int precision, int pointflag,
           PrintfTarget *target)
{
...
        /* Handle +/- */
        if (dosign && adjust_sign((value < 0), forcesign, &signvalue))
                value = -value;

If value already is INT64_MIN this can't work.  It just happens to fail
to fail, because the later cast with (uint64) value "hides" the damage.

I suspect the best way to fix this, would be to instead do:

	/* Handle +/- */
	if (dosign && adjust_sign((value < 0), forcesign, &signvalue);
		uvalue = -(uint64) value;
	else
		uvalue = (uint64) value;

Greetings,

Andres Freund


Commits

  1. Ensure that snprintf.c's fmtint() doesn't overflow when printing INT64_MIN.