database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-08 11:42:09 +03:00
Code Activity

Fix bug that allowed any logged-in user to SET ROLE to any other database user

Browse Source 
id (CVE-2006-0553).  Also fix related bug in SET SESSION AUTHORIZATION that
allows unprivileged users to crash the server, if it has been compiled with
Asserts enabled.  The escalation-of-privilege risk exists only in 8.1.0-8.1.2.
However, the Assert-crash risk exists in all releases back to 7.3.
Thanks to Akio Ishida for reporting this problem.
This commit is contained in:
Tom Lane
2006-02-12 22:32:57 +00:00
parent b71e2bb122
commit 20334a9e86
4 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/commands/variable.c
View File

@ -9,7 +9,7 @@
*
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.114.2.1 2005/11/22 18:23:08 momjian Exp $
* $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.114.2.2 2006/02/12 22:32:56 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@ -586,7 +586,9 @@ assign_client_encoding(const char *value, bool doit, GucSource source)
* by the numeric oid, followed by a comma, followed by the role name.
* This cannot be confused with a plain role name because of the NAMEDATALEN
* limit on names, so we can tell whether we're being passed an initial
* role name or a saved/restored value.
* role name or a saved/restored value. (NOTE: we rely on guc.c to have
* properly truncated any incoming value, but not to truncate already-stored
* values. See GUC_IS_NAME processing.)
*/
extern char *session_authorization_string; /* in guc.c */

4
src/backend/utils/mb/encnames.c
View File

@ -2,7 +2,7 @@
* Encoding names and routines for work with it. All
* in this file is shared bedween FE and BE.
*
* $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.26 2005/10/15 02:49:33 momjian Exp $
* $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.26.2.1 2006/02/12 22:32:56 tgl Exp $
*/
#ifdef FRONTEND
#include "postgres_fe.h"
@ -449,7 +449,7 @@ pg_char_to_encname_struct(const char *name)
if (name == NULL || *name == '\0')
return NULL;
if (strlen(name) > NAMEDATALEN)
if (strlen(name) >= NAMEDATALEN)
{
#ifdef FRONTEND
fprintf(stderr, "encoding name too long\n");

20
src/backend/utils/misc/guc.c
View File

@ -10,7 +10,7 @@
* Written by Peter Eisentraut <peter_e@gmx.net>.
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.299.2.1 2005/11/22 18:23:24 momjian Exp $
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.299.2.2 2006/02/12 22:32:57 tgl Exp $
*
*--------------------------------------------------------------------
*/
@ -48,6 +48,7 @@
#include "optimizer/prep.h"
#include "parser/parse_expr.h"
#include "parser/parse_relation.h"
#include "parser/scansup.h"
#include "postmaster/autovacuum.h"
#include "postmaster/bgwriter.h"
#include "postmaster/syslogger.h"
@ -1662,7 +1663,7 @@ static struct config_string ConfigureNamesString[] =
{"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE,
gettext_noop("Sets the client's character set encoding."),
NULL,
GUC_REPORT
GUC_IS_NAME | GUC_REPORT
},
&client_encoding_string,
"SQL_ASCII", assign_client_encoding, NULL
@ -1742,7 +1743,8 @@ static struct config_string ConfigureNamesString[] =
{
{"default_tablespace", PGC_USERSET, CLIENT_CONN_STATEMENT,
gettext_noop("Sets the default tablespace to create tables and indexes in."),
gettext_noop("An empty string selects the database's default tablespace.")
gettext_noop("An empty string selects the database's default tablespace."),
GUC_IS_NAME
},
&default_tablespace,
"", assign_default_tablespace, NULL
@ -1900,7 +1902,7 @@ static struct config_string ConfigureNamesString[] =
{"server_encoding", PGC_INTERNAL, CLIENT_CONN_LOCALE,
gettext_noop("Sets the server (database) character set encoding."),
NULL,
GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
GUC_IS_NAME | GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
},
&server_encoding_string,
"SQL_ASCII", NULL, NULL
@ -1922,7 +1924,7 @@ static struct config_string ConfigureNamesString[] =
{"role", PGC_USERSET, UNGROUPED,
gettext_noop("Sets the current role."),
NULL,
GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
GUC_IS_NAME | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
},
&role_string,
"none", assign_role, show_role
@ -1933,7 +1935,7 @@ static struct config_string ConfigureNamesString[] =
{"session_authorization", PGC_USERSET, UNGROUPED,
gettext_noop("Sets the session user name."),
NULL,
GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
GUC_IS_NAME | GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
},
&session_authorization_string,
NULL, assign_session_authorization, show_session_authorization
@ -3934,6 +3936,12 @@ set_config_option(const char *name, const char *value,
newval = guc_strdup(elevel, value);
if (newval == NULL)
return false;
/*
* The only sort of "parsing" check we need to do is
* apply truncation if GUC_IS_NAME.
*/
if (conf->gen.flags & GUC_IS_NAME)
truncate_identifier(newval, strlen(newval), true);
}
else if (conf->reset_val)
{

3
src/include/utils/guc_tables.h
View File

@ -7,7 +7,7 @@
*
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
*
* $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.20 2005/07/14 05:13:44 tgl Exp $
* $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.20.2.1 2006/02/12 22:32:57 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@ -126,6 +126,7 @@ struct config_generic
#define GUC_DISALLOW_IN_FILE 0x0040 /* can't set in postgresql.conf */
#define GUC_CUSTOM_PLACEHOLDER 0x0080 /* placeholder for custom variable */
#define GUC_SUPERUSER_ONLY 0x0100 /* show only to superusers */
#define GUC_IS_NAME 0x0200 /* limit string to NAMEDATALEN-1 */
/* bit values in status field */
#define GUC_HAVE_TENTATIVE 0x0001 /* tentative value is defined */