database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-16 06:01:02 +03:00
Code Activity

Prevent stack overflow in json-related functions.

Browse Source 
Sufficiently-deep recursion heretofore elicited a SIGSEGV.  If an
application constructs PostgreSQL json or jsonb values from arbitrary
user input, application users could have exploited this to terminate all
active database connections.  That applies to 9.3, where the json parser
adopted recursive descent, and later versions.  Only row_to_json() and
array_to_json() were at risk in 9.2, both in a non-security capacity.
Back-patch to 9.2, where the json type was introduced.

Oskari Saarenmaa, reviewed by Michael Paquier.

Security: CVE-2015-5289
This commit is contained in:
Noah Misch
2015-10-05 10:06:29 -04:00
parent 1d812c8b05
commit 08fa47c485
9 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/utils/adt/json.c
View File

@ -490,6 +490,8 @@ parse_object(JsonLexContext *lex, JsonSemAction *sem)
json_struct_action oend = sem->object_end;
JsonTokenType tok;
check_stack_depth();
if (ostart != NULL)
(*ostart) (sem->semstate);
@ -568,6 +570,8 @@ parse_array(JsonLexContext *lex, JsonSemAction *sem)
json_struct_action astart = sem->array_start;
json_struct_action aend = sem->array_end;
check_stack_depth();
if (astart != NULL)
(*astart) (sem->semstate);
@ -1433,6 +1437,8 @@ datum_to_json(Datum val, bool is_null, StringInfo result,
char *outputstr;
text *jsontext;
check_stack_depth();
/* callers are expected to ensure that null keys are not passed in */
Assert(!(key_scalar && is_null));