Fix integer overflow in text_format function, reported by Dean Rasheed.

In the passing, clarify the comment on why text_format_nv wrapper is needed.

diff --git a/src/backend/utils/adt/varlena.c b/src/backend/utils/adt/varlena.c
index 9d96013d57e9de4c7b1f5cb75ac1a0f22a624c06..6005d685764720abf0c8c89288eac9bee3e54474 100644 (file)
--- a/src/backend/utils/adt/varlena.c
+++ b/src/backend/utils/adt/varlena.c
@@ -3827,7 +3827,19 @@ text_format(PG_FUNCTION_ARGS)
         * to the next one.  If they have, we must parse it.
         */
        if (*cp < '0' || *cp > '9')
+       {
            ++arg;
+           if (arg <= 0)                       /* overflow? */
+           {
+               /*
+                * Should not happen, as you can't pass billions of arguments
+                * to a function, but better safe than sorry.
+                */
+               ereport(ERROR,
+                       (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE),
+                        errmsg("argument number is out of range")));
+           }
+       }
        else
        {
            bool        unterminated = false;
@@ -3836,10 +3848,13 @@ text_format(PG_FUNCTION_ARGS)
            arg = 0;
            do
            {
-               /* Treat overflowing arg position as unterminated. */
-               if (arg > INT_MAX / 10)
-                   break;
-               arg = arg * 10 + (*cp - '0');
+               int     newarg = arg * 10 + (*cp - '0');
+
+               if (newarg / 10 != arg)         /* overflow? */
+                   ereport(ERROR,
+                           (errcode(ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE),
+                            errmsg("argument number is out of range")));
+               arg = newarg;
                ++cp;
            } while (cp < end_ptr && *cp >= '0' && *cp <= '9');
 
@@ -3954,7 +3969,9 @@ text_format_string_conversion(StringInfo buf, char conversion,
 /*
  * text_format_nv - nonvariadic wrapper for text_format function.
  *
- * note: this wrapper is necessary to be sanity_checks test ok
+ * note: this wrapper is necessary to pass the sanity check in opr_sanity,
+ * which checks that all built-in functions that share the implementing C
+ * function take the same number of arguments.
  */
 Datum
 text_format_nv(PG_FUNCTION_ARGS)