From bc311905d21de00d04556a13cdcc3ae2b13c846d Mon Sep 17 00:00:00 2001 From: Haibo Yan Date: Mon, 16 Jun 2025 12:14:10 -0700 Subject: [PATCH] Mitigate potential overflow risks from wcscpy The use of wcscpy for copying user-supplied input into buffers is inherently unsafe and can lead to buffer overflows. This commit replaces wcscpy with wcsncpy to ensure proper bounds checking and mitigate potential overflow vulnerabilities. --- src/backend/utils/adt/pg_locale.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/backend/utils/adt/pg_locale.c b/src/backend/utils/adt/pg_locale.c index a858f27cadc..31eff4e3477 100644 --- a/src/backend/utils/adt/pg_locale.c +++ b/src/backend/utils/adt/pg_locale.c @@ -928,7 +928,7 @@ search_locale_enum(LPWSTR pStr, DWORD dwFlags, LPARAM lparam) { if (_wcsicmp(argv[0], test_locale) == 0) { - wcscpy(argv[1], pStr); + wcsncpy(argv[1], pStr, LOCALE_NAME_MAX_LENGTH - 1); *argv[2] = (wchar_t) 1; return FALSE; } @@ -951,7 +951,7 @@ search_locale_enum(LPWSTR pStr, DWORD dwFlags, LPARAM lparam) { if (_wcsicmp(argv[0], test_locale) == 0) { - wcscpy(argv[1], pStr); + wcsncpy(argv[1], pStr, LOCALE_NAME_MAX_LENGTH - 1); *argv[2] = (wchar_t) 1; return FALSE; } -- 2.49.0