From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
---|---|
To: | Dean Rasheed <dean(dot)a(dot)rasheed(at)gmail(dot)com> |
Cc: | pgsql-bugs(at)postgresql(dot)org |
Subject: | Re: Seg-fault in format(text) |
Date: | 2011-05-23 14:33:11 |
Message-ID: | 12736.1306161191@sss.pgh.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs |
Dean Rasheed <dean(dot)a(dot)rasheed(at)gmail(dot)com> writes:
> Testing 9.1beta:
> select format('Hello %s, %2147483648$s', 'World');
> server closed the connection unexpectedly
Yeah, same here.
> do
> {
> /* Treat overflowing arg position as unterminated. */
> ! if (arg > INT_MAX / 10)
> break;
> arg = arg * 10 + (*cp - '0');
> ++cp;
> --- 3837,3843 ----
> do
> {
> /* Treat overflowing arg position as unterminated. */
> ! if (arg >= INT_MAX / 10)
> break;
> arg = arg * 10 + (*cp - '0');
> ++cp;
Not sure I trust this fix to catch all cases --- seems like the addition
could still overflow. It'd probably be better if we made this code look
like the overflow test in scanint8:
int64 newtmp = tmp * 10 + (*ptr++ - '0');
if ((newtmp / 10) != tmp) /* overflow? */
regards, tom lane
From | Date | Subject | |
---|---|---|---|
Next Message | Heikki Linnakangas | 2011-05-23 15:10:51 | Re: Seg-fault in format(text) |
Previous Message | Dean Rasheed | 2011-05-23 14:02:51 | Seg-fault in format(text) |