BUG #18614: [ECPG] out of bound in DecodeDateTime

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: p(dot)nekrasov(at)fobos-nt(dot)ru
Subject: BUG #18614: [ECPG] out of bound in DecodeDateTime
Date: 2024-09-12 08:54:42
Message-ID: 18614-6bbe00117352309e@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 18614
Logged by: Pavel Nekrasov
Email address: p(dot)nekrasov(at)fobos-nt(dot)ru
PostgreSQL version: 17rc1
Operating system: Alt 10
Description:

in the line ```if (tm->tm_mday < 1 || tm->tm_mday >
day_tab[isleap(tm->tm_year)][tm->tm_mon - 1]) ``` tm->tm_mon may be equal to
0, which will result in reading by indexes -1

this is possible when calling PGTYPESdate_from_asc or
PGTYPEStimestamp_from_asc with "str" equal, for example, "AM95000062"

Patch:

--- a/src/interfaces/ecpg/pgtypeslib/dt_common.c
+++ b/src/interfaces/ecpg/pgtypeslib/dt_common.c
@@ -2327,10 +2327,9 @@ DecodeDateTime(char **field, int *ftype, int nf,
return ((fmask & DTK_TIME_M) == DTK_TIME_M) ? 1 : -1;

/*
- * check for valid day of month, now that we know for sure the month
- * and year...
+ * check for valid day of month and month, now that we know for sure the
year...
*/
- if (tm->tm_mday < 1 || tm->tm_mday >
day_tab[isleap(tm->tm_year)][tm->tm_mon - 1])
+ if (tm->tm_mon < 1 || tm->tm_mday < 1 || tm->tm_mday >
day_tab[isleap(tm->tm_year)][tm->tm_mon - 1])
return -1;

/*

Browse pgsql-bugs by date

  From Date Subject
Next Message Daniel Gustafsson 2024-09-12 10:04:51 Re: BUG #18612: Postgres crash with segfault on disk full - ____strtof_l_internal (strtod_l.c:1019)
Previous Message Duncan Sands 2024-09-12 08:27:52 pg_restore with --disable-triggers discards ENABLE ALWAYS