database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-09-02 04:21:28 +03:00
Code Activity

Add error-throwing wrappers for the printf family of functions.

Browse Source 
All known standard library implementations of these functions can fail
with ENOMEM.  A caller neglecting to check for failure would experience
missing output, information exposure, or a crash.  Check return values
within wrappers and code, currently just snprintf.c, that bypasses the
wrappers.  The wrappers do not return after an error, so their callers
need not check.  Back-patch to 9.0 (all supported versions).

Popular free software standard library implementations do take pains to
bypass malloc() in simple cases, but they risk ENOMEM for floating point
numbers, positional arguments, large field widths, and large precisions.
No specification demands such caution, so this commit regards every call
to a printf family function as a potential threat.

Injecting the wrappers implicitly is a compromise between patch scope
and design goals.  I would prefer to edit each call site to name a
wrapper explicitly.  libpq and the ECPG libraries would, ideally, convey
errors to the caller rather than abort().  All that would be painfully
invasive for a back-patched security fix, hence this compromise.

Security: CVE-2015-3166
This commit is contained in:
Noah Misch
2015-05-18 10:02:31 -04:00
parent cac18a76bb
commit 16304a0134
16 changed files with 300 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
src/include/port.h
View File

@@ -126,12 +126,11 @@ extern unsigned char pg_tolower(unsigned char ch);
extern unsigned char pg_ascii_toupper(unsigned char ch);
extern unsigned char pg_ascii_tolower(unsigned char ch);
#ifdef USE_REPL_SNPRINTF
/*
* Versions of libintl >= 0.13 try to replace printf() and friends with
* macros to their own versions that understand the %$ format. We do the
* same, so disable their macros, if they exist.
* Capture macro-compatible calls to printf() and friends, and redirect them
* to wrappers that throw errors in lieu of reporting failure in a return
* value. Versions of libintl >= 0.13 similarly redirect to versions that
* understand the %$ format, so disable libintl macros first.
*/
#ifdef vsnprintf
#undef vsnprintf
@@ -155,6 +154,55 @@ extern unsigned char pg_ascii_tolower(unsigned char ch);
#undef printf
#endif
extern int
vsnprintf_throw_on_fail(char *str, size_t count, const char *fmt, va_list args)
pg_attribute_printf(3, 0);
extern int
snprintf_throw_on_fail(char *str, size_t count, const char *fmt,...)
pg_attribute_printf(3, 4);
extern int
vsprintf_throw_on_fail(char *str, const char *fmt, va_list args)
pg_attribute_printf(2, 0);
extern int
sprintf_throw_on_fail(char *str, const char *fmt,...)
pg_attribute_printf(2, 3);
extern int
vfprintf_throw_on_fail(FILE *stream, const char *fmt, va_list args)
pg_attribute_printf(2, 0);
extern int
fprintf_throw_on_fail(FILE *stream, const char *fmt,...)
pg_attribute_printf(2, 3);
extern int
printf_throw_on_fail(const char *fmt,...)
pg_attribute_printf(1, 2);
/*
* The GCC-specific code below prevents the pg_attribute_printf above from
* being replaced, and this is required because gcc doesn't know anything
* about printf_throw_on_fail.
*/
#ifdef __GNUC__
#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__)
#define snprintf(...) snprintf_throw_on_fail(__VA_ARGS__)
#define vsprintf(...) vsprintf_throw_on_fail(__VA_ARGS__)
#define sprintf(...) sprintf_throw_on_fail(__VA_ARGS__)
#define vfprintf(...) vfprintf_throw_on_fail(__VA_ARGS__)
#define fprintf(...) fprintf_throw_on_fail(__VA_ARGS__)
#define printf(...) printf_throw_on_fail(__VA_ARGS__)
#else
#define vsnprintf vsnprintf_throw_on_fail
#define snprintf snprintf_throw_on_fail
#define vsprintf vsprintf_throw_on_fail
#define sprintf sprintf_throw_on_fail
#define vfprintf vfprintf_throw_on_fail
#define fprintf fprintf_throw_on_fail
#define printf printf_throw_on_fail
#endif
#ifdef USE_REPL_SNPRINTF
/* Code outside syswrap.c should not call these. */
extern int pg_vsnprintf(char *str, size_t count, const char *fmt, va_list args);
extern int pg_snprintf(char *str, size_t count, const char *fmt,...) pg_attribute_printf(3, 4);
extern int pg_vsprintf(char *str, const char *fmt, va_list args);
@@ -163,28 +211,6 @@ extern int pg_vfprintf(FILE *stream, const char *fmt, va_list args);
extern int pg_fprintf(FILE *stream, const char *fmt,...) pg_attribute_printf(2, 3);
extern int pg_printf(const char *fmt,...) pg_attribute_printf(1, 2);
/*
* The GCC-specific code below prevents the pg_attribute_printf above from
* being replaced, and this is required because gcc doesn't know anything
* about pg_printf.
*/
#ifdef __GNUC__
#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
#define snprintf(...) pg_snprintf(__VA_ARGS__)
#define vsprintf(...) pg_vsprintf(__VA_ARGS__)
#define sprintf(...) pg_sprintf(__VA_ARGS__)
#define vfprintf(...) pg_vfprintf(__VA_ARGS__)
#define fprintf(...) pg_fprintf(__VA_ARGS__)
#define printf(...) pg_printf(__VA_ARGS__)
#else
#define vsnprintf pg_vsnprintf
#define snprintf pg_snprintf
#define vsprintf pg_vsprintf
#define sprintf pg_sprintf
#define vfprintf pg_vfprintf
#define fprintf pg_fprintf
#define printf pg_printf
#endif
#endif /* USE_REPL_SNPRINTF */
#if defined(WIN32)