From: Andrey Rachitskiy Date: Fri, 31 Jul 2026 14:58:00 +0500 Subject: [PATCH] Reject out-of-range millennia in Y,YYY parsing DCH_Y_YYY parsed the millennia component with sscanf("%d"), which silently truncates values outside int range. Inputs like 4294969320,024 (2^32+2024) were therefore accepted as year 2024024 instead of being rejected. Parse millennia with strtol() using the same ERANGE / INT_MIN / INT_MAX checks as from_char_parse_int_len(). Keep the bounded %03d scan for the years component and the existing mul/add overflow checks. Author: Andrey Rachitskiy Reported-by: Michael Malis Discussion: https://www.postgresql.org/message-id/19590-991c467c2a601be0%40postgresql.org --- diff --git a/src/backend/utils/adt/formatting.c b/src/backend/utils/adt/formatting.c index d52d71b0a8c..8e2716a2f91 100644 --- a/src/backend/utils/adt/formatting.c +++ b/src/backend/utils/adt/formatting.c @@ -3543,13 +3543,29 @@ DCH_from_char(FormatNode *node, const char *in, TmFromChar *out, break; case DCH_Y_YYY: { - int matched, - years, + char *endp; + int years, millennia, nch; + long lval; - matched = sscanf(s, "%d,%03d%n", &millennia, &years, &nch); - if (matched < 2) + errno = 0; + lval = strtol(s, &endp, 10); + if (endp == s || *endp != ',') + ereturn(escontext,, + (errcode(ERRCODE_INVALID_DATETIME_FORMAT), + errmsg("invalid value \"%s\" for \"%s\"", s, "Y,YYY"))); + if (errno == ERANGE || lval < INT_MIN || lval > INT_MAX) + ereturn(escontext,, + (errcode(ERRCODE_DATETIME_VALUE_OUT_OF_RANGE), + errmsg("value for \"%s\" in source string is out of range", + "Y,YYY"), + errdetail("Value must be in the range %d to %d.", + INT_MIN, INT_MAX))); + millennia = (int) lval; + + /* %03d: width limits conversion to 3 chars, fits in int */ + if (sscanf(endp + 1, "%03d%n", &years, &nch) < 1) ereturn(escontext,, (errcode(ERRCODE_INVALID_DATETIME_FORMAT), errmsg("invalid value \"%s\" for \"%s\"", s, "Y,YYY"))); @@ -3564,7 +3580,7 @@ DCH_from_char(FormatNode *node, const char *in, TmFromChar *out, if (!from_char_set_int(&out->year, years, n, escontext)) return; out->yysz = 4; - s += nch; + s = endp + 1 + nch; SKIP_THth(s, n->suffix); } break; diff --git a/src/test/regress/expected/horology.out b/src/test/regress/expected/horology.out index 32cf62b6741..ee60fb0e5bf 100644 --- a/src/test/regress/expected/horology.out +++ b/src/test/regress/expected/horology.out @@ -3772,6 +3772,21 @@ SELECT to_timestamp('2015-02-11 86400', 'YYYY-MM-DD SSSSS'); ERROR: date/time field value out of range: "2015-02-11 86400" SELECT to_timestamp('1000000000,999', 'Y,YYY'); ERROR: value for "Y,YYY" in source string is out of range +-- millennia too large for int: +SELECT to_date('4294969320,024', 'Y,YYY'); +ERROR: value for "Y,YYY" in source string is out of range +DETAIL: Value must be in the range -2147483648 to 2147483647. +SELECT to_date('-4294965272,024', 'Y,YYY'); +ERROR: value for "Y,YYY" in source string is out of range +DETAIL: Value must be in the range -2147483648 to 2147483647. +SELECT to_timestamp('4294969320,024', 'Y,YYY'); +ERROR: value for "Y,YYY" in source string is out of range +DETAIL: Value must be in the range -2147483648 to 2147483647. +-- malformed Y,YYY (no comma / no years after comma): +SELECT to_date('2024', 'Y,YYY'); +ERROR: invalid value "2024" for "Y,YYY" +SELECT to_date('2,', 'Y,YYY'); +ERROR: invalid value "2," for "Y,YYY" SELECT to_timestamp('0.-2147483648', 'SS.MS'); ERROR: date/time field value out of range: "0.-2147483648" SELECT to_timestamp('613566758', 'W'); diff --git a/src/test/regress/sql/horology.sql b/src/test/regress/sql/horology.sql index 8978249a5dc..c4dff557a68 100644 --- a/src/test/regress/sql/horology.sql +++ b/src/test/regress/sql/horology.sql @@ -657,6 +657,13 @@ SELECT to_timestamp('2015-02-11 86400', 'YYYY-MM-DD SSSS'); SELECT to_timestamp('2015-02-11 86000', 'YYYY-MM-DD SSSSS'); -- ok SELECT to_timestamp('2015-02-11 86400', 'YYYY-MM-DD SSSSS'); SELECT to_timestamp('1000000000,999', 'Y,YYY'); +-- millennia too large for int: +SELECT to_date('4294969320,024', 'Y,YYY'); +SELECT to_date('-4294965272,024', 'Y,YYY'); +SELECT to_timestamp('4294969320,024', 'Y,YYY'); +-- malformed Y,YYY (no comma / no years after comma): +SELECT to_date('2024', 'Y,YYY'); +SELECT to_date('2,', 'Y,YYY'); SELECT to_timestamp('0.-2147483648', 'SS.MS'); SELECT to_timestamp('613566758', 'W'); SELECT to_timestamp('2024 613566758 1', 'YYYY WW D');