From 63e0d612f5a53d76218d4e59a35287391e284561 Mon Sep 17 00:00:00 2001 From: Neil Conway Date: Thu, 26 May 2005 02:04:14 +0000 Subject: Adjust datetime parsing to be more robust. We now pass the length of the working buffer into ParseDateTime() and reject too-long input there, rather than checking the length of the input string before calling ParseDateTime(). The old method was bogus because ParseDateTime() can use a variable amount of working space, depending on the content of the input string (e.g. how many fields need to be NUL terminated). This fixes a minor stack overrun -- I don't _think_ it's exploitable, although I won't claim to be an expert. Along the way, fix a bug reported by Mark Dilger: the working buffer allocated by interval_in() was too short, which resulted in rejecting some perfectly valid interval input values. I added a regression test for this fix. --- src/include/utils/datetime.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/include/utils') diff --git a/src/include/utils/datetime.h b/src/include/utils/datetime.h index 532cfb9206..47817d1b34 100644 --- a/src/include/utils/datetime.h +++ b/src/include/utils/datetime.h @@ -9,7 +9,7 @@ * Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group * Portions Copyright (c) 1994, Regents of the University of California * - * $PostgreSQL: pgsql/src/include/utils/datetime.h,v 1.53 2005/05/24 04:03:01 momjian Exp $ + * $PostgreSQL: pgsql/src/include/utils/datetime.h,v 1.54 2005/05/26 02:04:14 neilc Exp $ * *------------------------------------------------------------------------- */ @@ -276,7 +276,7 @@ extern void GetCurrentTimeUsec(struct pg_tm * tm, fsec_t *fsec, int *tzp); extern void j2date(int jd, int *year, int *month, int *day); extern int date2j(int year, int month, int day); -extern int ParseDateTime(const char *timestr, char *lowstr, +extern int ParseDateTime(const char *timestr, char *workbuf, size_t buflen, char **field, int *ftype, int maxfields, int *numfields); extern int DecodeDateTime(char **field, int *ftype, -- cgit v1.2.1