вт, 11 авг. 2026 г. в 19:31, Andrey Rachitskiy <[email protected]>:
> Hi, Hackers!
>
> PGTYPESdate_fmt_asc() replaces fixed-width tokens in place. "yyyy"
> is four characters. Callers typically size outbuf as
> strlen(fmtstring)+1, as dt_test does.
>
> For year >= 10000, "%04u" produces five or more digits. memcpy()
> over the "yyyy" span overruns that token and clobbers the trailing
> NUL in a strlen(fmt)+1 buffer. ASan reports a heap-buffer-overflow
> on the next strstr() in the token loop.
> ```
> const char *fmt = "yyyy";
> date d = PGTYPESdate_from_asc("10000-01-01", NULL);
> char *out = malloc(strlen(fmt) + 1);
>
> PGTYPESdate_fmt_asc(d, fmt, out);
> ```
> The attached patch rejects a replacement longer than the token and
> sets errno to PGTYPES_DATE_BAD_DATE. A dt_test case is included.
>
> Hi, All!
Maybe someone will have some free time to do a review. Thanks a lot in
advance.
--
Regards,
Rachitskiy Andrey
