Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports.
Reported-by: Hcamael <[email protected]> Author: Michael Paquier <[email protected]> Reviewed-by: Robert Haas <[email protected]> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/42d333a78233599a25b34b66af940a87446d58c5 Author: Michael Paquier <[email protected]> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/input/encoding.source | 12 ++++++++++++ src/test/regress/output/encoding.source | 19 +++++++++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-)
