From f0d8e75f7385af2b7e9c621a2538da5e4e9e0148 Mon Sep 17 00:00:00 2001 From: Jeff Davis Date: Tue, 18 Aug 2026 14:57:32 -0700 Subject: [PATCH v1] ltree/crc32.c: fix fragile code. Explicitly make space for the NUL when casefolding. No known bug in the previous code, because the buffer was more than large enough for folding any codepoint with enough room left for a NUL. But it was fragile, and would break if UNICODE_CASEMAP_BUFSZ were a tighter bound. Backpatch-through: 18 --- contrib/ltree/crc32.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/ltree/crc32.c b/contrib/ltree/crc32.c index d21bed31fdd..617cc652a7a 100644 --- a/contrib/ltree/crc32.c +++ b/contrib/ltree/crc32.c @@ -32,13 +32,13 @@ ltree_crc32_sz(const char *buf, int size) INIT_TRADITIONAL_CRC32(crc); while (size > 0) { - char foldstr[UNICODE_CASEMAP_BUFSZ]; + char foldstr[UNICODE_CASEMAP_BUFSZ + 1]; int srclen = pg_mblen_range(p, end); size_t foldlen; /* fold one codepoint at a time */ - foldlen = pg_strfold(foldstr, UNICODE_CASEMAP_BUFSZ, p, srclen, - locale); + foldlen = pg_strfold(foldstr, sizeof(foldstr), p, srclen, locale); + Assert(foldlen < sizeof(foldstr)); COMP_TRADITIONAL_CRC32(crc, foldstr, foldlen); -- 2.43.0