Fix potential buffer overrun in regexp match/split functions. setup_regexp_matches() sizes the buffer used to convert matched substrings back from pg_wchar form at the smaller of maxlen*eml and the original string's byte length, on the assumption that such a conversion cannot produce more bytes than the string it came from. That assumption holds only for validly encoded input. But pg_mb2wchar_with_len() silently accepts bytes that are invalid in the database encoding, turning each such byte into one pg_wchar, and converting that back can take more bytes than the input did. A string made of such bytes therefore overruns the conversion buffer by up to its own length, corrupting the following memory. regexp_match(), regexp_matches(), regexp_split_to_table() and regexp_split_to_array() are all affected.
Fix by dropping the tighter bound and always allocating maxlen*eml + 1 bytes. Reported-by: Francesco Verardi <[email protected]> Author: Masahiko Sawada <[email protected]> Reviewed-by: Tom Lane <[email protected]> Backpatch-through: 14 Security: CVE-2026-14664 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3179253c20e0e90398589d7dff9d8630bacb271c Author: Masahiko Sawada <[email protected]> Modified Files -------------- src/backend/utils/adt/regexp.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
