pgsql: Guard against overlength time zone abbreviations in to_char().

Guard against overlength time zone abbreviations in to_char().

While typical abbreviations are only a few bytes long, a user-supplied
time_zone setting could specify a much longer abbreviation, enough to
overflow to_char's allocation of 12 bytes per format character. If so,
throw an error in the same style as commit 9241c84cb (CVE-2015-0241).

Reported-by: Hcamael <baiyjrh(at)gmail(dot)com>
Reported-by: Amjad Shahzad <amjadshahzad2000(at)gmail(dot)com>
Reported-by: Tan Zhen of AntAISecurityLab <TanZhen(dot)AntAI(at)outlook(dot)com>
Reported-by: Tomer Fichman <tomer(at)irregular(dot)com>
Reported-by: Zheng Yu <zheng(at)depthfirst(dot)com>
Reported-by: Amy Burnett (OpenAI Codex Security)
Reported-by: Rick de Jager <rick(at)v12(dot)sh>
Reported-by: Heewon Song <asteria121(at)78researchlab(dot)com>
Reported-by: Sylvie Mayer <smayer(at)cloudflare(dot)com>
Reported-by: Aleksander Alekseev <aleksander(at)tigerdata(dot)com>
Reported-by: Hillai Ben Sasson <hillai(dot)bensasson(at)wiz(dot)io>
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Backpatch-through: 14
Security: CVE-2026-14669

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/3294ab83947270a44f680a1725383e6521315b70
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>

Modified Files
--------------
src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)