database/pgbackrest
1
0
Fork 0
mirror of https://github.com/pgbackrest/pgbackrest.git synced 2026-10-23 21:28:56 +03:00
Code Activity

Error on invalid field ids when reading packs.

Browse Source 
pckReadTagNext() cut the high-order bits of the field id delta down to an unsigned int and added it to the last id without checking the result. A large delta could produce UINT_MAX, the id that marks the end of a container, or wrap to an id at or below the last id. Either one left the read out of step with the tags, which asserted in debug builds and misread fields in production builds.

Error when the id is not greater than the last id or is UINT_MAX.
This commit is contained in:
David Steele
2026-10-12 10:36:16 +02:00
parent b63357ee89
commit 6963016c77
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/common/type/pack.c
View File

@@ -592,6 +592,9 @@ pckReadTagNext(PackRead *const this)
// Increment the next tag id
this->tagNextId += this->tagStack.top->idLast + 1;
// Error when the id wrapped or is UINT_MAX (end of container)
CHECK(FormatError, this->tagNextId > this->tagStack.top->idLast && this->tagNextId != UINT_MAX, "invalid field id");
// Get tag size if it exists
if (packTypeMapData[this->tagNextTypeMap].size &&
(this->tagNextValue > 0 || !packTypeMapData[this->tagNextTypeMap].valueSingleBit))

10
test/src/module/common/type/packTest.c
View File

@@ -340,6 +340,16 @@ testRun(void)
TEST_ASSIGN(packRead, pckReadNew(pckFromBuf(BUFSTRDEF("\255\255\255\255\255\255\255\255\255\255"))), "new read");
TEST_ERROR(pckReadU64Internal(packRead), FormatError, "unterminated varint-128 integer");
// -------------------------------------------------------------------------------------------------------------------------
TEST_TITLE("error on invalid field id");
TEST_ASSIGN(packRead, pckReadNew(pckFromBuf(BUFSTRDEF("\046\377\377\377\377\177"))), "new read");
TEST_ERROR(pckReadNext(packRead), FormatError, "invalid field id");
TEST_ASSIGN(packRead, pckReadNew(pckFromBuf(BUFSTRDEF("\040\046\377\377\377\377\177"))), "new read");
TEST_RESULT_BOOL(pckReadBoolP(packRead), false, "read bool");
TEST_ERROR(pckReadNext(packRead), FormatError, "invalid field id");
// -------------------------------------------------------------------------------------------------------------------------
TEST_TITLE("read const packs");