Hi,

I was able to crash postgres 6.5.3 when I did an 'alter user' command. 
After I started a debugger I found the problem in the timezone handling of 
datetime (my Linux box lost its timezone information, that's how the 
problem occurred).

Only 7 bytes are reserved for the timezone, without checking for boundaries.

Attached is a patch that fixes this problem and emits a NOTICE if a 
timezone is encountered that is longer than MAXTZLEN bytes, like this:

template1=# alter user postgres with password postgres;
NOTICE:  Invalid timezone 'Local time zone must be set--see zic manual page'
NOTICE:  Invalid timezone 'Local time zone must be set--see zic manual page'
ALTER USER

I don't know whether the timezone should be reset to some predefined 
constant (like "GMT") if an error like this occurs. This patch at least 
directs the user in a general direction that something is wrong with his setup.

Cheers,

Jeroen
Wed, 08 Dec 1999 17:56:21 +0100
Jeroen van Vianen <jeroen@design.nl>
Small timezone bug fixed

Applied.


> Hi,
> 
> I was able to crash postgres 6.5.3 when I did an 'alter user' command. 
> After I started a debugger I found the problem in the timezone handling of 
> datetime (my Linux box lost its timezone information, that's how the 
> problem occurred).
> 
> Only 7 bytes are reserved for the timezone, without checking for boundaries.
> 
> Attached is a patch that fixes this problem and emits a NOTICE if a 
> timezone is encountered that is longer than MAXTZLEN bytes, like this:
> 
> template1=# alter user postgres with password postgres;
> NOTICE:  Invalid timezone 'Local time zone must be set--see zic manual page'
> NOTICE:  Invalid timezone 'Local time zone must be set--see zic manual page'
> ALTER USER
> 
> I don't know whether the timezone should be reset to some predefined 
> constant (like "GMT") if an error like this occurs. This patch at least 
> directs the user in a general direction that something is wrong with his setup.
> 
> Cheers,
> 
> Jeroen 

[Attachment, skipping...]


-- 
  Bruce Momjian                        |  http://www.op.net/~candle
  maillist@candle.pha.pa.us            |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

Thu, 9 Dec 1999 00:02:13 -0500 (EST)
Bruce Momjian <pgman@candle.pha.pa.us>
Re: [HACKERS] Small timezone bug fixed