Detect buffer underflow in get_th()

Alexander Kuznetsov <kuznetsovam@altlinux.org>

From: Alexander Kuznetsov <kuznetsovam@altlinux.org>
To: pgsql-hackers@lists.postgresql.org
Cc: nickel@altlinux.org, egori@altlinux.org
Date: 2024-07-24T09:43:19Z
Lists: pgsql-hackers

Attachments

Hello everyone,

In src/backend/utils/adt/formatting.c:1516, there is a get_th() function utilized to return ST/ND/RD/TH suffixes for simple numbers.
Upon reviewing its behavior, it appears capable of receiving non-numeric inputs (this is verified by a check at formatting.c:1527).

Given that the function can accept non-numeric inputs,
it is plausible that it could also receive an empty input,
although a brief examination of its calls did not reveal any such instances.

Nevertheless, if the function were to receive an empty input of zero length,
a buffer underflow would occur when attempting to compute *(num + (len - 1)), as (len - 1) would result in a negative shift.
To mitigate this issue, I propose a patch incorporating the zero_length_character_string error code, as detailed in the attachment.

-- 
Best regards,
Alexander Kuznetsov

Commits

  1. Detect buffer underflow in get_th()