imad <immaad@gmail.com> writes:
> This is the problematic part in formatting.c, function "dch_time".
> int siz = strlen(tmtcTzn(tmtc));
>
> if (arg == DCH_TZ)
> strcpy(inout, tmtcTzn(tmtc));
> else
> {
> char *p = palloc(siz);
>
> strcpy(p, tmtcTzn(tmtc));
> strcpy(inout, str_tolower(p));
> pfree(p);
> }
> return siz;
Hmm. That was not the buffer overrun I was looking at, but it sure
looks like another one :-(. Thanks for spotting it!
regards, tom lane