Re: Small patch to improve safety of utf8_to_unicode().

Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com> writes:
> On Jul 7, 2026, at 17:56, Jeff Davis <pgsql(at)j-davis(dot)com> wrote:
>> I'd like to wait for more comments before I commit these last two
>> patches, to see if the functions are generally useful for other callers
>> as well.

> V6 looks good to me.

Coverity is unimpressed, although after reading 07211f64a I wonder if
this patch didn't simply trigger it to pick up a pre-existing problem
(it does seem to act that way sometimes). It now complains:

/srv/coverity/git/pgsql-git/postgresql/src/common/unicode_case.c: 324 in convert_case()
318 }
319
320 if (result_len < dstsize)
321 dst[result_len] = '\0';
322
323 *pconsumed = srcoff;
>>> CID 1696680: (INTEGER_OVERFLOW)
>>> "result_len", which might have overflowed, is returned from the function.
324 return result_len;
325 }

What I think this is pointing out is that even if the input string's
length fits in size_t, the length of the case-converted equivalent
string might not. The code won't write past dstsize, but it will
try to compute the full output length required, and it won't notice
if result_len overflows and wraps around.

I would have written this off as an unreachable edge case, but our
recent experience with unicode_normalize (cf. commit 066b7b144)
makes me hesitant to assume that case-folding can't result in
integer-multiple growth of the string length. If it can, the overflow
might be reachable on 32-bit platforms, resulting in a silently-broken
result (but no memory clobber AFAICS).

Catering for this case seems like it would require messy warts on the
casefolding functions' API. So if we can convince ourselves that
overflow can't really occur, I'd be content to add a comment
demonstrating that. But if we can't prove that, I think we need some
warts :-(

regards, tom lane