Skip site navigation (1) Skip section navigation (2)

Re: date_in and buffer overrun

From: Heikki Linnakangas <hlinnakangas(at)vmware(dot)com>
To: Hitoshi Harada <umi(dot)tanuki(at)gmail(dot)com>
Cc: PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: date_in and buffer overrun
Date: 2012-10-02 08:05:06
Message-ID: 506AA032.8@vmware.com (view raw or flat)
Thread:
Lists: pgsql-hackers
On 02.10.2012 01:30, Hitoshi Harada wrote:
> It seems date_in() has a risk of buffer overrun.  If the input is '.',
> it sets field[0] to the beginning of workbuf and goes into
> DecodeDate().  This function checks null-termination of the head of
> string, but it can go beyond the end of string inside the first loop
> and replace some bytes with zero.  The worst scenario we've seen is
> overwrite of the stack frame, in which the compiler rearranged the
> memory allocation of local variables in date_in() and work_buf is at
> lower address than field.
>
> I tried to attach a patch file but failed somehow, so I paste the fix here.

Thanks, applied to master and all supported back-branches.

- Heikki


In response to

pgsql-hackers by date

Next:From: Heikki LinnakangasDate: 2012-10-02 08:26:24
Subject: Re: BUG #7534: walreceiver takes long time to detect n/w breakdown
Previous:From: Alexander KorotkovDate: 2012-10-02 07:45:56
Subject: Patch for removng unused targets

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group