database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-29 13:56:47 +03:00
Code

Avoid possibly-unsafe use of Windows' FormatMessage() function.

Browse Source 
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash.  This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.

Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
This commit is contained in:
Tom Lane 2016-03-29 11:54:57 -04:00
parent d77841d1ce
commit 2fed676c93
4 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/backend/libpq/auth.c
View File

@ -1013,7 +1013,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
{ {
char sysmsg[256]; char sysmsg[256];
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM,
NULL, r, 0,
sysmsg, sizeof(sysmsg), NULL) == 0) sysmsg, sizeof(sysmsg), NULL) == 0)
ereport(severity, ereport(severity,
(errmsg_internal("%s", errmsg), (errmsg_internal("%s", errmsg),

4
src/backend/port/win32/socket.c
View File

@ -657,7 +657,9 @@ pgwin32_socket_strerror(int err)
} }
ZeroMemory(&wserrbuf, sizeof(wserrbuf)); ZeroMemory(&wserrbuf, sizeof(wserrbuf));
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE, if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_FROM_HMODULE,
handleDLL, handleDLL,
err, err,
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),

4
src/interfaces/libpq/fe-auth.c
View File

@ -234,7 +234,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
{ {
char sysmsg[256]; char sysmsg[256];
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM,
NULL, r, 0,
sysmsg, sizeof(sysmsg), NULL) == 0) sysmsg, sizeof(sysmsg), NULL) == 0)
printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x", printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x",
mprefix, (unsigned int) r); mprefix, (unsigned int) r);

8
src/port/dirmod.c
View File

@ -206,7 +206,9 @@ pgsymlink(const char *oldpath, const char *newpath)
LPSTR msg; LPSTR msg;
errno = 0; errno = 0;
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(), NULL, GetLastError(),
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
(LPSTR) &msg, 0, NULL); (LPSTR) &msg, 0, NULL);
@ -281,7 +283,9 @@ pgreadlink(const char *path, char *buf, size_t size)
LPSTR msg; LPSTR msg;
errno = 0; errno = 0;
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_IGNORE_INSERTS |
FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(), NULL, GetLastError(),
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
(LPSTR) &msg, 0, NULL); (LPSTR) &msg, 0, NULL);