Added buffer length checks

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 08a99485627b0201e068733eee7d64480192ff0c..b1187b9c2ab69d839ba04b4c7104b7c3633ef4a0 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -5485,7 +5485,7 @@ static inline int build_assignment_string(smart_str *querystr, HashTable *ht, co
                                smart_str_append_long(querystr, Z_LVAL_PP(val));
                                break;
                        case IS_DOUBLE:
-                               smart_str_appendl(querystr, buf, sprintf(buf, "%f", Z_DVAL_PP(val)));
+                               smart_str_appendl(querystr, buf, MIN(snprintf(buf, sizeof(buf), "%f", Z_DVAL_PP(val)), sizeof(buf)-1));
                                break;
                        default:
                                /* should not happen */