mirror of
https://github.com/postgres/postgres.git
synced 2025-07-02 09:02:37 +03:00
Revert error-throwing wrappers for the printf family of functions.
This reverts commit16304a0134
, except for its changes in src/port/snprintf.c; as well as commitcac18a76bb
which is no longer needed. Fujii Masao reported that the previous commit caused failures in psql on OS X, since if one exits the pager program early while viewing a query result, psql sees an EPIPE error from fprintf --- and the wrapper function thought that was reason to panic. (It's a bit surprising that the same does not happen on Linux.) Further discussion among the security list concluded that the risk of other such failures was far too great, and that the one-size-fits-all approach to error handling embodied in the previous patch is unlikely to be workable. This leaves us again exposed to the possibility of the type of failure envisioned in CVE-2015-3166. However, that failure mode is strictly hypothetical at this point: there is no concrete reason to believe that an attacker could trigger information disclosure through the supposed mechanism. In the first place, the attack surface is fairly limited, since so much of what the backend does with format strings goes through stringinfo.c or psprintf(), and those already had adequate defenses. In the second place, even granting that an unprivileged attacker could control the occurrence of ENOMEM with some precision, it's a stretch to believe that he could induce it just where the target buffer contains some valuable information. So we concluded that the risk of non-hypothetical problems induced by the patch greatly outweighs the security risks. We will therefore revert, and instead undertake closer analysis to identify specific calls that may need hardening, rather than attempt a universal solution. We have kept the portion of the previous patch that improved snprintf.c's handling of errors when it calls the platform's sprintf(). That seems to be an unalloyed improvement. Security: CVE-2015-3166
This commit is contained in:
@ -48,7 +48,6 @@ submake-pgtypeslib:
|
||||
# Shared library stuff
|
||||
include $(top_srcdir)/src/Makefile.shlib
|
||||
|
||||
# XXX This library uses no symbols from snprintf.c.
|
||||
snprintf.c: % : $(top_srcdir)/src/port/%
|
||||
rm -f $@ && $(LN_S) $< .
|
||||
|
||||
|
1
src/interfaces/ecpg/ecpglib/.gitignore
vendored
1
src/interfaces/ecpg/ecpglib/.gitignore
vendored
@ -5,7 +5,6 @@
|
||||
/pgstrcasecmp.c
|
||||
/snprintf.c
|
||||
/strlcpy.c
|
||||
/syswrap.c
|
||||
/thread.c
|
||||
/win32setlocale.c
|
||||
/isinf.c
|
||||
|
@ -26,7 +26,7 @@ override CFLAGS += $(PTHREAD_CFLAGS)
|
||||
LIBS := $(filter-out -lpgport, $(LIBS))
|
||||
|
||||
OBJS= execute.o typename.o descriptor.o sqlda.o data.o error.o prepare.o memory.o \
|
||||
connect.o misc.o path.o pgstrcasecmp.o syswrap.o \
|
||||
connect.o misc.o path.o pgstrcasecmp.o \
|
||||
$(filter snprintf.o strlcpy.o win32setlocale.o isinf.o, $(LIBOBJS)) $(WIN32RES)
|
||||
|
||||
# thread.c is needed only for non-WIN32 implementation of path.c
|
||||
@ -55,7 +55,7 @@ include $(top_srcdir)/src/Makefile.shlib
|
||||
# necessarily use the same object files as the backend uses. Instead,
|
||||
# symlink the source files in here and build our own object file.
|
||||
|
||||
path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c win32setlocale.c isinf.c: % : $(top_srcdir)/src/port/%
|
||||
path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c win32setlocale.c isinf.c: % : $(top_srcdir)/src/port/%
|
||||
rm -f $@ && $(LN_S) $< .
|
||||
|
||||
misc.o: misc.c $(top_builddir)/src/port/pg_config_paths.h
|
||||
@ -72,6 +72,6 @@ uninstall: uninstall-lib
|
||||
|
||||
clean distclean: clean-lib
|
||||
rm -f $(OBJS)
|
||||
rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c syswrap.c thread.c win32setlocale.c isinf.c
|
||||
rm -f path.c pgstrcasecmp.c snprintf.c strlcpy.c thread.c win32setlocale.c isinf.c
|
||||
|
||||
maintainer-clean: distclean maintainer-clean-lib
|
||||
|
1
src/interfaces/ecpg/pgtypeslib/.gitignore
vendored
1
src/interfaces/ecpg/pgtypeslib/.gitignore
vendored
@ -4,4 +4,3 @@
|
||||
/pgstrcasecmp.c
|
||||
/rint.c
|
||||
/snprintf.c
|
||||
/syswrap.c
|
||||
|
@ -30,7 +30,7 @@ SHLIB_LINK += -lm
|
||||
SHLIB_EXPORTS = exports.txt
|
||||
|
||||
OBJS= numeric.o datetime.o common.o dt_common.o timestamp.o interval.o \
|
||||
pgstrcasecmp.o syswrap.o \
|
||||
pgstrcasecmp.o \
|
||||
$(filter rint.o snprintf.o, $(LIBOBJS)) $(WIN32RES)
|
||||
|
||||
all: all-lib
|
||||
@ -43,7 +43,7 @@ include $(top_srcdir)/src/Makefile.shlib
|
||||
# necessarily use the same object files as the backend uses. Instead,
|
||||
# symlink the source files in here and build our own object file.
|
||||
|
||||
pgstrcasecmp.c rint.c snprintf.c syswrap.c: % : $(top_srcdir)/src/port/%
|
||||
pgstrcasecmp.c rint.c snprintf.c: % : $(top_srcdir)/src/port/%
|
||||
rm -f $@ && $(LN_S) $< .
|
||||
|
||||
install: all installdirs install-lib
|
||||
@ -53,6 +53,6 @@ installdirs: installdirs-lib
|
||||
uninstall: uninstall-lib
|
||||
|
||||
clean distclean: clean-lib
|
||||
rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c syswrap.c
|
||||
rm -f $(OBJS) pgstrcasecmp.c rint.c snprintf.c
|
||||
|
||||
maintainer-clean: distclean maintainer-clean-lib
|
||||
|
Reference in New Issue
Block a user