You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by re...@apache.org on 2026/09/01 06:20:05 UTC
(cloudberry) 19/21: Guard against overlength time zone abbreviations in to_char().
This is an automated email from the ASF dual-hosted git repository.
reshke pushed a commit to branch REL_2_STABLE
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 83f59e0ae73fc586794ca25c9ef28212aa20e584
Author: Tom Lane <tg...@sss.pgh.pa.us>
AuthorDate: Mon Aug 10 06:37:47 2026 -0700
Guard against overlength time zone abbreviations in to_char().
While typical abbreviations are only a few bytes long, a user-supplied
time_zone setting could specify a much longer abbreviation, enough to
overflow to_char's allocation of 12 bytes per format character. If so,
throw an error in the same style as commit 9241c84cb (CVE-2015-0241).
Reported-by: Hcamael <ba...@gmail.com>
Reported-by: Amjad Shahzad <am...@gmail.com>
Reported-by: Tan Zhen of AntAISecurityLab <Ta...@outlook.com>
Reported-by: Tomer Fichman <to...@irregular.com>
Reported-by: Zheng Yu <zh...@depthfirst.com>
Reported-by: Amy Burnett (OpenAI Codex Security)
Reported-by: Rick de Jager <ri...@v12.sh>
Reported-by: Heewon Song <as...@78researchlab.com>
Reported-by: Sylvie Mayer <sm...@cloudflare.com>
Reported-by: Aleksander Alekseev <al...@tigerdata.com>
Reported-by: Hillai Ben Sasson <hi...@wiz.io>
Author: Tom Lane <tg...@sss.pgh.pa.us>
Backpatch-through: 14
Security: CVE-2026-14669
---
src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c
index a72546711c9..13a3ba380ec 100644
--- a/src/backend/utils/adt/formatting.c
+++ b/src/backend/utils/adt/formatting.c
@@ -2772,10 +2772,18 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col
INVALID_FOR_INTERVAL;
if (tmtcTzn(in))
{
- /* We assume here that timezone names aren't localized */
+ /*
+ * We assume here that timezone abbreviations aren't
+ * localized, so ASCII-only downcasing is sufficient.
+ */
char *p = asc_tolower_z(tmtcTzn(in));
- strcpy(s, p);
+ if (strlen(p) <= n->key->len * DCH_MAX_ITEM_SIZ)
+ strcpy(s, p);
+ else
+ ereport(ERROR,
+ (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE),
+ errmsg("time zone format value too long")));
pfree(p);
s += strlen(s);
}
@@ -2784,7 +2792,14 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col
INVALID_FOR_INTERVAL;
if (tmtcTzn(in))
{
- strcpy(s, tmtcTzn(in));
+ const char *p = tmtcTzn(in);
+
+ if (strlen(p) <= n->key->len * DCH_MAX_ITEM_SIZ)
+ strcpy(s, p);
+ else
+ ereport(ERROR,
+ (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE),
+ errmsg("time zone format value too long")));
s += strlen(s);
}
break;
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org