This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 83f59e0ae73fc586794ca25c9ef28212aa20e584 Author: Tom Lane <[email protected]> AuthorDate: Mon Aug 10 06:37:47 2026 -0700 Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241). Reported-by: Hcamael <[email protected]> Reported-by: Amjad Shahzad <[email protected]> Reported-by: Tan Zhen of AntAISecurityLab <[email protected]> Reported-by: Tomer Fichman <[email protected]> Reported-by: Zheng Yu <[email protected]> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <[email protected]> Reported-by: Heewon Song <[email protected]> Reported-by: Sylvie Mayer <[email protected]> Reported-by: Aleksander Alekseev <[email protected]> Reported-by: Hillai Ben Sasson <[email protected]> Author: Tom Lane <[email protected]> Backpatch-through: 14 Security: CVE-2026-14669 --- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c index a72546711c9..13a3ba380ec 100644 --- a/src/backend/utils/adt/formatting.c +++ b/src/backend/utils/adt/formatting.c @@ -2772,10 +2772,18 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col INVALID_FOR_INTERVAL; if (tmtcTzn(in)) { - /* We assume here that timezone names aren't localized */ + /* + * We assume here that timezone abbreviations aren't + * localized, so ASCII-only downcasing is sufficient. + */ char *p = asc_tolower_z(tmtcTzn(in)); - strcpy(s, p); + if (strlen(p) <= n->key->len * DCH_MAX_ITEM_SIZ) + strcpy(s, p); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("time zone format value too long"))); pfree(p); s += strlen(s); } @@ -2784,7 +2792,14 @@ DCH_to_char(FormatNode *node, bool is_interval, TmToChar *in, char *out, Oid col INVALID_FOR_INTERVAL; if (tmtcTzn(in)) { - strcpy(s, tmtcTzn(in)); + const char *p = tmtcTzn(in); + + if (strlen(p) <= n->key->len * DCH_MAX_ITEM_SIZ) + strcpy(s, p); + else + ereport(ERROR, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("time zone format value too long"))); s += strlen(s); } break; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
