From e09651e9d90011ff634ac1c10c8e67e3881687c8 Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Mon, 2 Feb 2015 10:00:45 -0500 Subject: [PATCH] to_char(): prevent writing beyond the allocated buffer Previously very long localized month and weekday strings could overflow the allocated buffers, causing a server crash. Reported and patch reviewed by Noah Misch. Backpatch to all supported versions. Security: CVE-2015-0241 --- src/backend/utils/adt/formatting.c | 139 ++++++++++++++++++++++++++--- 1 file changed, 125 insertions(+), 14 deletions(-) diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c index a8b538229e..d8a9c8cc38 100644 --- a/src/backend/utils/adt/formatting.c +++ b/src/backend/utils/adt/formatting.c @@ -110,7 +110,7 @@ * Maximal length of one node * ---------- */ -#define DCH_MAX_ITEM_SIZ 9 /* max julian day */ +#define DCH_MAX_ITEM_SIZ 12 /* max localized day name */ #define NUM_MAX_ITEM_SIZ 8 /* roman number (RN has 15 chars) */ /* ---------- @@ -525,10 +525,12 @@ do { \ * Suffixes definition for DATE-TIME TO/FROM CHAR * ---------- */ +#define TM_SUFFIX_LEN 2 + static KeySuffix DCH_suff[] = { {"FM", 2, DCH_S_FM, SUFFTYPE_PREFIX}, {"fm", 2, DCH_S_FM, SUFFTYPE_PREFIX}, - {"TM", 2, DCH_S_TM, SUFFTYPE_PREFIX}, + {"TM", TM_SUFFIX_LEN, DCH_S_TM, SUFFTYPE_PREFIX}, {"tm", 2, DCH_S_TM, SUFFTYPE_PREFIX}, {"TH", 2, DCH_S_TH, SUFFTYPE_POSTFIX}, {"th", 2, DCH_S_th, SUFFTYPE_POSTFIX}, @@ -537,6 +539,7 @@ static KeySuffix DCH_suff[] = { {NULL, 0, 0, 0} }; + /* ---------- * Format-pictures (KeyWord). * @@ -2534,7 +2537,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_toupper_z(localized_full_months[tm->tm_mon - 1], collid)); + { + char *str = str_toupper_z(localized_full_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, asc_toupper_z(months_full[tm->tm_mon - 1])); @@ -2545,7 +2557,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_initcap_z(localized_full_months[tm->tm_mon - 1], collid)); + { + char *str = str_initcap_z(localized_full_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, months_full[tm->tm_mon - 1]); @@ -2556,7 +2577,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_tolower_z(localized_full_months[tm->tm_mon - 1], collid)); + { + char *str = str_tolower_z(localized_full_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, asc_tolower_z(months_full[tm->tm_mon - 1])); @@ -2567,7 +2597,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_toupper_z(localized_abbrev_months[tm->tm_mon - 1], collid)); + { + char *str = str_toupper_z(localized_abbrev_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, asc_toupper_z(months[tm->tm_mon - 1])); s += strlen(s); @@ -2577,7 +2616,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_initcap_z(localized_abbrev_months[tm->tm_mon - 1], collid)); + { + char *str = str_initcap_z(localized_abbrev_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, months[tm->tm_mon - 1]); s += strlen(s); @@ -2587,7 +2635,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col if (!tm->tm_mon) break; if (S_TM(n->suffix)) - strcpy(s, str_tolower_z(localized_abbrev_months[tm->tm_mon - 1], collid)); + { + char *str = str_tolower_z(localized_abbrev_months[tm->tm_mon - 1], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, asc_tolower_z(months[tm->tm_mon - 1])); s += strlen(s); @@ -2601,7 +2658,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_DAY: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_toupper_z(localized_full_days[tm->tm_wday], collid)); + { + char *str = str_toupper_z(localized_full_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, asc_toupper_z(days[tm->tm_wday])); @@ -2610,7 +2676,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_Day: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_initcap_z(localized_full_days[tm->tm_wday], collid)); + { + char *str = str_initcap_z(localized_full_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, days[tm->tm_wday]); @@ -2619,7 +2694,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_day: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_tolower_z(localized_full_days[tm->tm_wday], collid)); + { + char *str = str_tolower_z(localized_full_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else sprintf(s, "%*s", S_FM(n->suffix) ? 0 : -9, asc_tolower_z(days[tm->tm_wday])); @@ -2628,7 +2712,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_DY: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_toupper_z(localized_abbrev_days[tm->tm_wday], collid)); + { + char *str = str_toupper_z(localized_abbrev_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, asc_toupper_z(days_short[tm->tm_wday])); s += strlen(s); @@ -2636,7 +2729,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_Dy: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_initcap_z(localized_abbrev_days[tm->tm_wday], collid)); + { + char *str = str_initcap_z(localized_abbrev_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, days_short[tm->tm_wday]); s += strlen(s); @@ -2644,7 +2746,16 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col case DCH_dy: INVALID_FOR_INTERVAL; if (S_TM(n->suffix)) - strcpy(s, str_tolower_z(localized_abbrev_days[tm->tm_wday], collid)); + { + char *str = str_tolower_z(localized_abbrev_days[tm->tm_wday], collid); + + if (strlen(str) < (n->key->len + TM_SUFFIX_LEN) * DCH_MAX_ITEM_SIZ) + strcpy(s, str); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("localized string format value too long"))); + } else strcpy(s, asc_tolower_z(days_short[tm->tm_wday])); s += strlen(s); -- 2.40.0