From: Bruce Momjian <bruce@momjian.us>
Date: Mon, 2 Feb 2015 15:00:44 +0000 (-0500)
Subject: to_char():  prevent accesses beyond the allocated buffer
X-Git-Tag: REL9_1_15~7
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=037529a11c96a09c85b8bbc443f8301067c0ef22;p=postgresql

to_char():  prevent accesses beyond the allocated buffer

Previously very long field masks for floats could access memory
beyond the existing buffer allocated to hold the result.

Reported by Andres Freund and Peter Geoghegan.	Backpatch to all
supported versions.

Security: CVE-2015-0241
---

diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c
index dc9bf6d7e7..e3eed90f20 100644
--- a/src/backend/utils/adt/formatting.c
+++ b/src/backend/utils/adt/formatting.c
@@ -4390,7 +4390,9 @@ NUM_numpart_to_char(NUMProc *Np, int id)
 					Np->num_in = TRUE;
 				}
 			}
-			++Np->number_p;
+			/* do no exceed string length */
+			if (*Np->number_p)
+				++Np->number_p;
 		}
 
 		end = Np->num_count + (Np->out_pre_spaces ? 1 : 0) + (IS_DECIMAL(Np->Num) ? 1 : 0);