database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-12-19 17:02:53 +03:00
Code Activity

Tighten parsing of datetime input.

Browse Source 
ParseFraction only expects to deal with fields that contain a decimal
point and digit(s).  However it's possible in some edge cases for it
to be passed input that doesn't look like that.  In particular the
input could look like a valid floating-point number, such as ".123e6".
strtod() will happily eat that, possibly producing a result that is
not within the expected range 0..1, which can result in integer
overflow in the callers.  That doesn't have any security consequences,
but it's still not very desirable.  Fix by checking that the input
has the expected form.

Similarly, DecodeNumberField only expects to deal with fields that
contain a decimal point and digit(s), but it's sometimes abused to
parse strings that might not look like that.  This could result in
failure to reject bogus input, yielding silly results.  Again, fix
by rejecting input that doesn't look as-expected.  That decision
also means that we can affirmatively answer the very old comment
questioning whether we couldn't save some duplicative code by
using ParseFractionalSecond here.

While these changes should only reject input that nobody would
consider valid, it still doesn't seem like a change to make in
stable branches.  Apply to HEAD only.

Reported-by: Evgeniy Gorbanev <gorbanev.es@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/1328335.1748371099@sss.pgh.pa.us
This commit is contained in:
Tom Lane
2025-05-28 15:10:48 -04:00
parent be86ca103a
commit e5d64fd654
3 changed files with 38 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/test/regress/expected/horology.out
View File

@@ -467,6 +467,15 @@ SELECT timestamp with time zone 'Y2001M12D27H04MM05S06.789-08';
ERROR: invalid input syntax for type timestamp with time zone: "Y2001M12D27H04MM05S06.789-08"
LINE 1: SELECT timestamp with time zone 'Y2001M12D27H04MM05S06.789-0...
^
-- More examples we used to accept and should not
SELECT timestamp with time zone 'J2452271 T X03456-08';
ERROR: invalid input syntax for type timestamp with time zone: "J2452271 T X03456-08"
LINE 1: SELECT timestamp with time zone 'J2452271 T X03456-08';
^
SELECT timestamp with time zone 'J2452271 T X03456.001e6-08';
ERROR: invalid input syntax for type timestamp with time zone: "J2452271 T X03456.001e6-08"
LINE 1: SELECT timestamp with time zone 'J2452271 T X03456.001e6-08'...
^
-- conflicting fields should throw errors
SELECT date '1995-08-06 epoch';
ERROR: invalid input syntax for type date: "1995-08-06 epoch"

4
src/test/regress/sql/horology.sql
View File

@@ -102,6 +102,10 @@ SELECT date 'J J 1520447';
SELECT timestamp with time zone 'Y2001M12D27H04M05S06.789+08';
SELECT timestamp with time zone 'Y2001M12D27H04MM05S06.789-08';
-- More examples we used to accept and should not
SELECT timestamp with time zone 'J2452271 T X03456-08';
SELECT timestamp with time zone 'J2452271 T X03456.001e6-08';
-- conflicting fields should throw errors
SELECT date '1995-08-06 epoch';
SELECT date '1995-08-06 infinity';