database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Fix contrib/seg to be more wary of long input numbers.

Browse Source 
seg stores the number of significant digits in an input number
in a "char" field.  If char is signed, and the input is more than
127 digits long, the count can read out as negative causing
seg_out() to print garbage (or, if you're really unlucky,
even crash).

To fix, clamp the digit count to be not more than FLT_DIG.
(In theory this loses some information about what the original
input was, but it doesn't seem like useful information; it would
not survive dump/restore in any case.)

Also, in case there are stored values of the seg type containing
bad data, add a clamp in seg_out's restore() subroutine.

Per bug #17725 from Robins Tharakan.  It's been like this
forever, so back-patch to all supported branches.

Discussion: https://postgr.es/m/17725-0a09313b67fbe86e@postgresql.org
This commit is contained in:
Tom Lane
2022-12-21 17:51:50 -05:00
parent 33dd895ef3
commit 701c881f78
4 changed files with 33 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
contrib/seg/seg.c
View File

@ -928,9 +928,13 @@ restore(char *result, float val, int n)
/*
* Put a cap on the number of significant digits to avoid garbage in the
* output and ensure we don't overrun the result buffer.
* output and ensure we don't overrun the result buffer. (n should not be
* negative, but check to protect ourselves against corrupted data.)
*/
n = Min(n, FLT_DIG);
if (n <= 0)
n = FLT_DIG;
else
n = Min(n, FLT_DIG);
/* remember the sign */
sign = (val < 0 ? 1 : 0);