From: | neilc(at)svr1(dot)postgresql(dot)org (Neil Conway) |
---|---|
To: | pgsql-committers(at)postgresql(dot)org |
Subject: | pgsql: Adjust datetime parsing to be more robust. |
Date: | 2005-05-26 02:14:32 |
Message-ID: | 20050526021432.828B752839@svr1.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers |
Log Message:
-----------
Adjust datetime parsing to be more robust. We now pass the length of the
working buffer into ParseDateTime() and reject too-long input there,
rather than checking the length of the input string before calling
ParseDateTime(). The old method was bogus because ParseDateTime() can use
a variable amount of working space, depending on the content of the
input string (e.g. how many fields need to be NUL terminated). This fixes
a minor stack overrun -- I don't _think_ it's exploitable, although I
won't claim to be an expert.
Along the way, fix a bug reported by Mark Dilger: the working buffer
allocated by interval_in() was too short, which resulted in rejecting
some perfectly valid interval input values. I added a regression test for
this fix.
Tags:
----
REL7_4_STABLE
Modified Files:
--------------
pgsql/src/backend/utils/adt:
date.c (r1.93.2.2 -> r1.93.2.3)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/date.c.diff?r1=1.93.2.2&r2=1.93.2.3)
datetime.c (r1.118.2.5 -> r1.118.2.6)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/datetime.c.diff?r1=1.118.2.5&r2=1.118.2.6)
nabstime.c (r1.117.2.1 -> r1.117.2.2)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/nabstime.c.diff?r1=1.117.2.1&r2=1.117.2.2)
timestamp.c (r1.96.2.2 -> r1.96.2.3)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/timestamp.c.diff?r1=1.96.2.2&r2=1.96.2.3)
pgsql/src/include/utils:
datetime.h (r1.45 -> r1.45.2.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/utils/datetime.h.diff?r1=1.45&r2=1.45.2.1)
pgsql/src/test/regress/expected:
interval.out (r1.9 -> r1.9.2.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/test/regress/expected/interval.out.diff?r1=1.9&r2=1.9.2.1)
pgsql/src/test/regress/sql:
interval.sql (r1.5 -> r1.5.4.1)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/test/regress/sql/interval.sql.diff?r1=1.5&r2=1.5.4.1)
From | Date | Subject | |
---|---|---|---|
Next Message | Neil Conway | 2005-05-26 03:18:53 | pgsql: Minor cleanup for recent SQLSTATE / SQLERRM patch: spell |
Previous Message | Neil Conway | 2005-05-26 02:10:03 | pgsql: Adjust datetime parsing to be more robust. |