(cloudberry) 14/22: Fix integer-overflow and alignment hazards in locale-related code.

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

reshke pushed a commit to branch REL_2_STABLE
in repository https://gitbox.apache.org/repos/asf/cloudberry.git

commit dfe23bf1a0265df6116b4d4fb7665d01d8078294
Author: Tom Lane <tg...@sss.pgh.pa.us>
AuthorDate: Mon May 11 05:13:51 2026 -0700

    Fix integer-overflow and alignment hazards in locale-related code.
    
    pg_locale_icu.c was full of places where a very long input string
    could cause integer overflow while calculating a buffer size,
    leading to buffer overruns.
    
    It also was cavalier about using char-type local arrays as buffers
    holding arrays of UChar.  The alignment of a char[] variable isn't
    guaranteed, so that this risked failure on alignment-picky platforms.
    The lack of complaints suggests that such platforms are very rare
    nowadays; but it's likely that we are paying a performance price on
    rather more platforms.  Declare those arrays as UChar[] instead,
    keeping their physical size the same.
    
    pg_locale_libc.c's strncoll_libc_win32_utf8() also had the
    disease of assuming it could double or quadruple the input
    string length without concern for overflow.
    
    Reported-by: Xint Code
    Reported-by: Pavel Kohout <pa...@aisle.com>
    Author: Tom Lane <tg...@sss.pgh.pa.us>
    Backpatch-through: 14
    Security: CVE-2026-6473
---
 src/backend/utils/adt/pg_locale.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/pg_locale.c b/src/backend/utils/adt/pg_locale.c
index a9acb875eee..5a6a60c3306 100644
--- a/src/backend/utils/adt/pg_locale.c
+++ b/src/backend/utils/adt/pg_locale.c
@@ -1804,7 +1804,7 @@ icu_to_uchar(UChar **buff_uchar, const char *buff, size_t nbytes)
 		ereport(ERROR,
 				(errmsg("%s failed: %s", "ucnv_toUChars", u_errorName(status))));
 
-	*buff_uchar = palloc((len_uchar + 1) * sizeof(**buff_uchar));
+	*buff_uchar = palloc_array(UChar, len_uchar + 1);
 
 	status = U_ZERO_ERROR;
 	len_uchar = ucnv_toUChars(icu_converter, *buff_uchar, len_uchar + 1,


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org