Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241).
Reported-by: Hcamael <[email protected]> Reported-by: Amjad Shahzad <[email protected]> Reported-by: Tan Zhen of AntAISecurityLab <[email protected]> Reported-by: Tomer Fichman <[email protected]> Reported-by: Zheng Yu <[email protected]> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <[email protected]> Reported-by: Heewon Song <[email protected]> Reported-by: Sylvie Mayer <[email protected]> Reported-by: Aleksander Alekseev <[email protected]> Reported-by: Hillai Ben Sasson <[email protected]> Author: Tom Lane <[email protected]> Backpatch-through: 14 Security: CVE-2026-14669 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4fafe23805c4c75c2e85e8a0c1675fd17d92977b Author: Tom Lane <[email protected]> Modified Files -------------- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
