Re: BUG #18614: [ECPG] out of bound in DecodeDateTime

Bruce Momjian <bruce@momjian.us>

From: Bruce Momjian <bruce@momjian.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: p.nekrasov@fobos-nt.ru, pgsql-bugs@lists.postgresql.org
Date: 2024-10-17T17:29:03Z
Lists: pgsql-bugs

Attachments

On Wed, Oct 16, 2024 at 09:18:10AM +0900, Michael Paquier wrote:
> On Mon, Oct 14, 2024 at 05:52:59PM -0400, Bruce Momjian wrote:
> >  		/*
> > -		 * check for valid day of month, now that we know for sure the month
> > +		 * check for valid day of month and month, now that we know for sure the month
> >  		 * and year...
> >  		 */
> > -		if (tm->tm_mday < 1 || tm->tm_mday > day_tab[isleap(tm->tm_year)][tm->tm_mon - 1])
> > +		if (tm->tm_mon < 1 || tm->tm_mday < 1 || tm->tm_mday > day_tab[isleap(tm->tm_year)][tm->tm_mon - 1])
> >  			return -1;
> 
> I would suggest adding a test.  This is tricky enough and really easy
> to miss, even if ECPG is not that touched these days.
> 
> There are a lot of callers of PGTYPEStimestamp_from_asc() in
> dt_test.pgc that do sanity checks on such inputs.

Added in the attached patch. Is the output correct?

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  When a patient asks the doctor, "Am I going to die?", he means 
  "Am I going to die soon?"

Commits

  1. ecpg: Fix out-of-bound read in DecodeDateTime()