RE: [PATCH] Fix heap-buffer-overflow in PGTYPEStimestamp_defmt_scan()

I'm sending you an updated patch. A test has been added to src/interfaces/ecpg/test/pgtypeslib/dt_test2.pgc. It works without compiling AddressSanitizer.

Test result before patch:
...
interval_copy[5]: @ 1 year 59 mins
Error parsing interval 6
free(): invalid next size (fast)
Aborted (core dumped)

After patch:
...
interval_copy[5]: @ 1 year 59 mins
Error parsing interval 6
Success parsing large string

--
Maria Sivirilova

-----Original Message-----
From: Daniel Gustafsson <daniel(at)yesql(dot)se>
Sent: Wednesday, August 19, 2026 3:12 PM
To: Сивирилова Мария Константиновна <m(dot)sivirilova(at)ftdata(dot)ru>
Cc: pgsql-hackers(at)lists(dot)postgresql(dot)org
Subject: Re: [PATCH] Fix heap-buffer-overflow in PGTYPEStimestamp_defmt_scan()

> On 19 Aug 2026, at 08:55, Sivirilova Marija <m(dot)sivirilova(at)ftdata(dot)ru> wrote:
>
> Hello, hackers!
> We used the Clang Static Analyzer and found a heap-buffer-overflow in the PGTYPEStimestamp_defmt_scan() function inside src/interfaces/ecpg/pgtypeslib/dt_common.c. When processing template tokens like '%D', '%r', '%R', or '%T', the code allocates a temporary buffer based on the length of the remaining input string (pstr). However, it later concatenates the remaining format string (pfmt) into this buffer using strcat(). If an application attempts to parse a short or truncated time string using a longer, complex format pattern, the format string suffix will exceed the allocated memory, causing a heap-buffer-overflow.
> The issue can be reproduced with a minimal test case (compiling this with AddressSanitizer):

Can you please add testcases to the patch, to make sure we cover these edgecases in the regression tests.

--
Daniel Gustafsson