(cloudberry) 12/22: Avoid overflow in size calculations in formatting.c.

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

reshke pushed a commit to branch REL_2_STABLE
in repository https://gitbox.apache.org/repos/asf/cloudberry.git

commit eeb4bf30b9ab1f284aa17258c32f0a83f020007f
Author: Nathan Bossart <na...@postgresql.org>
AuthorDate: Mon May 11 05:13:51 2026 -0700

    Avoid overflow in size calculations in formatting.c.
    
    A few functions in this file were incautious about multiplying a
    possibly large integer by a factor more than 1 and then using it as
    an allocation size.  This is harmless on 64-bit systems where we'd
    compute a size exceeding MaxAllocSize and then fail, but on 32-bit
    systems we could overflow size_t, leading to an undersized
    allocation and buffer overrun.  To fix, use palloc_array() or
    mul_size() instead of handwritten multiplication.
    
    Reported-by: Sven Klemm <sv...@tigerdata.com>
    Reported-by: Xint Code
    Author: Nathan Bossart <na...@gmail.com>
    Reviewed-by: Tom Lane <tg...@sss.pgh.pa.us>
    Reviewed-by: Tatsuo Ishii <is...@postgresql.org>
    Security: CVE-2026-6473
    Backpatch-through: 14
---
 src/backend/utils/adt/formatting.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c
index 7d58e28cd1e..84bb4d47330 100644
--- a/src/backend/utils/adt/formatting.c
+++ b/src/backend/utils/adt/formatting.c
@@ -4037,7 +4037,7 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt, bool is_interval, Oid collid)
 	/*
 	 * Allocate workspace for result as C string
 	 */
-	result = palloc((fmt_len * DCH_MAX_ITEM_SIZ) + 1);
+	result = palloc(mul_size(fmt_len, DCH_MAX_ITEM_SIZ) + 1);
 	*result = '\0';
 
 	if (fmt_len > DCH_CACHE_SIZE)
@@ -4048,7 +4048,7 @@ datetime_to_char_body(TmToChar *tmtc, text *fmt, bool is_interval, Oid collid)
 		 */
 		incache = false;
 
-		format = (FormatNode *) palloc((fmt_len + 1) * sizeof(FormatNode));
+		format = palloc_array(FormatNode, fmt_len + 1);
 
 		parse_format(format, fmt_str, DCH_keywords,
 					 DCH_suff, DCH_index, DCH_FLAG, NULL);
@@ -4504,7 +4504,7 @@ do_to_timestamp(text *date_txt, text *fmt, Oid collid, bool std,
 			 * Allocate new memory if format picture is bigger than static
 			 * cache and do not use cache (call parser always)
 			 */
-			format = (FormatNode *) palloc((fmt_len + 1) * sizeof(FormatNode));
+			format = palloc_array(FormatNode, fmt_len + 1);
 
 			parse_format(format, fmt_str, DCH_keywords, DCH_suff, DCH_index,
 						 DCH_FLAG | (std ? STD_FLAG : 0), NULL);
@@ -4979,7 +4979,7 @@ NUM_cache(int len, NUMDesc *Num, text *pars_str, bool *shouldFree)
 		 * Allocate new memory if format picture is bigger than static cache
 		 * and do not use cache (call parser always)
 		 */
-		format = (FormatNode *) palloc((len + 1) * sizeof(FormatNode));
+		format = palloc_array(FormatNode, len + 1);
 
 		*shouldFree = true;
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org