Re: write past chunk end in ExprContext / to_char - Mailing list pgsql-hackers

imad <immaad@gmail.com> writes:
> This is the problematic part in formatting.c, function "dch_time".
>                 int            siz = strlen(tmtcTzn(tmtc));
>
>                 if (arg == DCH_TZ)
>                     strcpy(inout, tmtcTzn(tmtc));
>                 else
>                 {
>                     char       *p = palloc(siz);
>
>                     strcpy(p, tmtcTzn(tmtc));
>                     strcpy(inout, str_tolower(p));
>                     pfree(p);
>                 }
>                 return siz;

Hmm.  That was not the buffer overrun I was looking at, but it sure
looks like another one :-(.  Thanks for spotting it!
        regards, tom lane