Repair problems with to_char() overrunning its input string.

From Karel Zak.

diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c
index cc31115fa6c371f160abca078522d8305699fbca..4407e450f9fc551e2aa874df8977ad7e225e03ee 100644 (file)
--- a/src/backend/utils/adt/formatting.c
+++ b/src/backend/utils/adt/formatting.c
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------
  * formatting.c
  *
- * $Header: /cvsroot/pgsql/src/backend/utils/adt/formatting.c,v 1.67 2003/08/25 16:13:27 tgl Exp $
+ * $Header: /cvsroot/pgsql/src/backend/utils/adt/formatting.c,v 1.68 2003/09/03 14:59:41 tgl Exp $
  *
  *
  *      Portions Copyright (c) 1999-2003, PostgreSQL Global Development Group
@@ -1294,6 +1294,16 @@ DCH_processor(FormatNode *node, char *inout, int flag, void *data)
 
        for (n = node, s = inout; n->type != NODE_TYPE_END; n++)
        {
+               if (flag == FROM_CHAR && *s=='\0')
+                       /*
+                        * The input string is shorter than format picture, 
+                        * so it's good time to break this loop...
+                        * 
+                        * Note: this isn't relevant for TO_CHAR mode, beacuse 
+                        *       it use 'inout' allocated by format picture length.
+                        */
+                       break;
+
                if (n->type == NODE_TYPE_ACTION)
                {
                        int                     len;
@@ -1328,9 +1338,8 @@ DCH_processor(FormatNode *node, char *inout, int flag, void *data)
                                }
                        }
                }
-
+               
                ++s;                                    /* ! */
-
        }
 
        if (flag == TO_CHAR)
@@ -2715,10 +2724,10 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt)
 {
        FormatNode *format;
        struct tm  *tm = NULL;
-       char       *str_fmt,
-                          *result;
-       bool            incache;
-       int                     len = VARSIZE(fmt) - VARHDRSZ;
+       char       *fmt_str,
+                  *result;
+       bool    incache;
+       int     fmt_len = VARSIZE(fmt) - VARHDRSZ;
 
        tm = tmtcTm(tmtc);
        tm->tm_wday = (date2j(tm->tm_year, tm->tm_mon, tm->tm_mday) + 1) % 7;
@@ -2727,29 +2736,28 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt)
        /*
         * Convert fmt to C string
         */
-       str_fmt = (char *) palloc(len + 1);
-       memcpy(str_fmt, VARDATA(fmt), len);
-       *(str_fmt + len) = '\0';
+       fmt_str = (char *) palloc(fmt_len + 1);
+       memcpy(fmt_str, VARDATA(fmt), fmt_len);
+       *(fmt_str + fmt_len) = '\0';
 
        /*
         * Allocate result
         */
-       result = palloc((len * DCH_MAX_ITEM_SIZ) + 1);
+       result = palloc((fmt_len * DCH_MAX_ITEM_SIZ) + 1);
 
        /*
         * Allocate new memory if format picture is bigger than static cache
-        * and not use cache (call parser always) - incache=FALSE show this
-        * variant
+        * and not use cache (call parser always) 
         */
-       if (len > DCH_CACHE_SIZE)
+       if (fmt_len > DCH_CACHE_SIZE)
        {
-               format = (FormatNode *) palloc((len + 1) * sizeof(FormatNode));
+               format = (FormatNode *) palloc((fmt_len + 1) * sizeof(FormatNode));
                incache = FALSE;
 
-               parse_format(format, str_fmt, DCH_keywords,
+               parse_format(format, fmt_str, DCH_keywords,
                                         DCH_suff, DCH_index, DCH_TYPE, NULL);
 
-               (format + len)->type = NODE_TYPE_END;   /* Paranoia? */
+               (format + fmt_len)->type = NODE_TYPE_END;       /* Paranoia? */
 
        }
        else
@@ -2758,25 +2766,24 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt)
                 * Use cache buffers
                 */
                DCHCacheEntry *ent;
-
                incache = TRUE;
 
-               if ((ent = DCH_cache_search(str_fmt)) == NULL)
+               if ((ent = DCH_cache_search(fmt_str)) == NULL)
                {
 
-                       ent = DCH_cache_getnew(str_fmt);
+                       ent = DCH_cache_getnew(fmt_str);
 
                        /*
                         * Not in the cache, must run parser and save a new
                         * format-picture to the cache.
                         */
-                       parse_format(ent->format, str_fmt, DCH_keywords,
+                       parse_format(ent->format, fmt_str, DCH_keywords,
                                                 DCH_suff, DCH_index, DCH_TYPE, NULL);
 
-                       (ent->format + len)->type = NODE_TYPE_END;      /* Paranoia? */
+                       (ent->format + fmt_len)->type = NODE_TYPE_END;  /* Paranoia? */
 
 #ifdef DEBUG_TO_FROM_CHAR
-                       /* dump_node(ent->format, len); */
+                       /* dump_node(ent->format, fmt_len); */
                        /* dump_index(DCH_keywords, DCH_index);  */
 #endif
                }
@@ -2788,22 +2795,27 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt)
        if (!incache)
                pfree(format);
 
-       pfree(str_fmt);
+       pfree(fmt_str);
 
        /*
         * for result is allocated max memory, which current format-picture
         * needs, now it allocate result with real size
         */
-       if (!(len = strlen(result)))
-               pfree(result);
-       else
+       if (result && *result)
        {
-               text       *res = (text *) palloc(len + 1 + VARHDRSZ);
+               int len = strlen(result);
+       
+               if (len)
+               {
+                       text       *res = (text *) palloc(len + 1 + VARHDRSZ);
 
-               memcpy(VARDATA(res), result, len);
-               VARATT_SIZEP(res) = len + VARHDRSZ;
-               return res;
+                       memcpy(VARDATA(res), result, len);
+                       VARATT_SIZEP(res) = len + VARHDRSZ;
+                       pfree(result);
+                       return res;
+               }
        }
+       pfree(result);
        return NULL;
 }
 
@@ -2953,39 +2965,39 @@ do_to_timestamp(text *date_txt, text *fmt,
 {
        FormatNode *format;
        TmFromChar      tmfc;
-       bool            incache;
-       char       *str;
-       char       *date_str;
-       int                     len,
-                               date_len;
+       int             fmt_len;
 
        ZERO_tm(tm);
        *fsec = 0;
 
        ZERO_tmfc(&tmfc);
 
-       len = VARSIZE(fmt) - VARHDRSZ;
+       fmt_len = VARSIZE(fmt) - VARHDRSZ;
 
-       if (len)
+       if (fmt_len)
        {
-               str = (char *) palloc(len + 1);
-               memcpy(str, VARDATA(fmt), len);
-               *(str + len) = '\0';
+               int date_len;
+               char *fmt_str;
+               char *date_str;
+               bool incache;
+               
+               fmt_str = (char *) palloc(fmt_len + 1);
+               memcpy(fmt_str, VARDATA(fmt), fmt_len);
+               *(fmt_str + fmt_len) = '\0';
 
                /*
                 * Allocate new memory if format picture is bigger than static
-                * cache and not use cache (call parser always) - incache=FALSE
-                * show this variant
+                * cache and not use cache (call parser always)
                 */
-               if (len > DCH_CACHE_SIZE)
+               if (fmt_len > DCH_CACHE_SIZE)
                {
-                       format = (FormatNode *) palloc((len + 1) * sizeof(FormatNode));
+                       format = (FormatNode *) palloc((fmt_len + 1) * sizeof(FormatNode));
                        incache = FALSE;
 
-                       parse_format(format, str, DCH_keywords,
+                       parse_format(format, fmt_str, DCH_keywords,
                                                 DCH_suff, DCH_index, DCH_TYPE, NULL);
 
-                       (format + len)->type = NODE_TYPE_END;           /* Paranoia? */
+                       (format + fmt_len)->type = NODE_TYPE_END;               /* Paranoia? */
                }
                else
                {
@@ -2993,24 +3005,23 @@ do_to_timestamp(text *date_txt, text *fmt,
                         * Use cache buffers
                         */
                        DCHCacheEntry *ent;
+                       incache = TRUE;
 
-                       incache = 0;
-
-                       if ((ent = DCH_cache_search(str)) == NULL)
+                       if ((ent = DCH_cache_search(fmt_str)) == NULL)
                        {
 
-                               ent = DCH_cache_getnew(str);
+                               ent = DCH_cache_getnew(fmt_str);
 
                                /*
                                 * Not in the cache, must run parser and save a new
                                 * format-picture to the cache.
                                 */
-                               parse_format(ent->format, str, DCH_keywords,
+                               parse_format(ent->format, fmt_str, DCH_keywords,
                                                         DCH_suff, DCH_index, DCH_TYPE, NULL);
 
-                               (ent->format + len)->type = NODE_TYPE_END;              /* Paranoia? */
+                               (ent->format + fmt_len)->type = NODE_TYPE_END;          /* Paranoia? */
 #ifdef DEBUG_TO_FROM_CHAR
-                               /* dump_node(ent->format, len); */
+                               /* dump_node(ent->format, fmt_len); */
                                /* dump_index(DCH_keywords, DCH_index); */
 #endif
                        }
@@ -3021,7 +3032,7 @@ do_to_timestamp(text *date_txt, text *fmt,
                 * Call action for each node in FormatNode tree
                 */
 #ifdef DEBUG_TO_FROM_CHAR
-               /* dump_node(format, len); */
+               /* dump_node(format, fmt_len); */
 #endif
 
                /*
@@ -3035,8 +3046,8 @@ do_to_timestamp(text *date_txt, text *fmt,
                DCH_processor(format, date_str, FROM_CHAR, (void *) &tmfc);
 
                pfree(date_str);
-               pfree(str);
-               if (incache)
+               pfree(fmt_str);
+               if (!incache)
                        pfree(format);
        }