Horton

Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thiago Nunes <thiagotnunes@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Date: 2023-03-15T01:45:46Z
Lists: pgsql-bugs 
Thiago Nunes <thiagotnunes@gmail.com> writes:
> I think your solution deals with all the cases, but I would like to point
> out how I fixed it locally. I recalculated Num.zero_end after this line (
> https://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/formatting.c#L6716
> ):

> ```
> Num.zero_end = Num.pre + Num.post;
> ```

Hmm ... that seems a bit ad-hoc, because as far as I understand this
code, zero_end is supposed to track where is the last '0' format
character.  That shouldn't change just because we decided that the
data value overflowed.

			regards, tom lane

Commits

  1. Fix corner case bug in numeric to_char() some more.