Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to provide in input data that was able to disclose a few bytes of server memory, allowing out-of-bound reads. - Specific bytes had values within the expected range, using a set of assertions to validate them. The assertions could be triggered on invalid input. These are replaced by tests and error reports.
Reported-by: Hcamael <[email protected]> Author: Michael Paquier <[email protected]> Reviewed-by: Robert Haas <[email protected]> Backpatch-through: 14 Security: CVE-2026-18024 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/a16c31d39c8bc1ed979b1b778238e3e1e72a311f Author: Michael Paquier <[email protected]> Modified Files -------------- src/backend/utils/adt/oracle_compat.c | 25 ++++++++++++++++++++----- src/test/regress/expected/encoding.out | 19 +++++++++++++++++++ src/test/regress/sql/encoding.sql | 12 ++++++++++++ 3 files changed, 51 insertions(+), 5 deletions(-)
