Re: BUG #17839: Heap-buffer overflow on float8_to_char with invalid template

Thanks Tom,

I think your solution deals with all the cases, but I would like to point
out how I fixed it locally. I recalculated Num.zero_end after this line (
https://github.com/postgres/postgres/blob/REL_15_2/src/backend/utils/adt/formatting.c#L6716
):

```
Num.zero_end = Num.pre + Num.post;
```

Cheers,

On Wed, Mar 15, 2023 at 9:49 AM Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:

> PG Bug reporting form <noreply(at)postgresql(dot)org> writes:
> > Heap-buffer overflow on float8_to_char when format exceeds max double
> > digits. I noticed this when running tests with memory sanitiser (msan).
> > The following example triggers the failure (considering max double digits
> > `DBL_DIG` is 15):
> > float8_to_char(12345678901, "FM9999999999D999990")
>
> Thanks for the report! For reasons that aren't entirely clear to me,
> valgrind didn't whine about this until I added a few more zeroes to the
> format string, like
>
> SELECT to_char('12345678901'::float8,
> 'FM9999999999D9999900000000000000000');
>
> Nonetheless, it did see the issue at that point. I'm inclined to fix
> it by making the code that adjusts Np->last_relevant more paranoid,
> as attached.
>
> regards, tom lane
>
>