pgsql: Avoid overflow in size calculations in formatting.c.

Avoid overflow in size calculations in formatting.c.

A few functions in this file were incautious about multiplying a
possibly large integer by a factor more than 1 and then using it as
an allocation size. This is harmless on 64-bit systems where we'd
compute a size exceeding MaxAllocSize and then fail, but on 32-bit
systems we could overflow size_t, leading to an undersized
allocation and buffer overrun. To fix, use palloc_array() or
mul_size() instead of handwritten multiplication.

Reported-by: Sven Klemm <sven(at)tigerdata(dot)com>
Reported-by: Xint Code
Author: Nathan Bossart <nathandbossart(at)gmail(dot)com>
Reviewed-by: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Reviewed-by: Tatsuo Ishii <ishii(at)postgresql(dot)org>
Security: CVE-2026-6473
Backpatch-through: 14

Branch
------
REL_14_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/98675336195b526edc69890d68a1dc0408d63b3f
Author: Nathan Bossart <nathan(at)postgresql(dot)org>

Modified Files
--------------
src/backend/utils/adt/formatting.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)