database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-29 13:56:47 +03:00
Code

Add missing error check in pgcrypto/crypt-md5.c.

Browse Source 
In theory, the second px_find_digest call in px_crypt_md5 could fail
even though the first one succeeded, since resource allocation is
required.  Don't skip testing for a failure.  (If one did happen,
the likely result would be a crash rather than clean recovery from
an OOM failure.)

The code's been like this all along, so back-patch to all supported
branches.

Daniel Gustafsson

Discussion: https://postgr.es/m/AA8D6FE9-4AB2-41B4-98CB-AE64BA668C03@yesql.se
This commit is contained in:
Tom Lane 2020-10-16 11:59:13 -04:00
parent 2cde0fd6fc
commit 3d338a46a4
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
contrib/pgcrypto/crypt-md5.c
View File

@ -65,11 +65,17 @@ px_crypt_md5(const char *pw, const char *salt, char *passwd, unsigned dstlen)
/* get the length of the true salt */ /* get the length of the true salt */
sl = ep - sp; sl = ep - sp;
/* */ /* we need two PX_MD objects */
err = px_find_digest("md5", &ctx); err = px_find_digest("md5", &ctx);
if (err) if (err)
return NULL; return NULL;
err = px_find_digest("md5", &ctx1); err = px_find_digest("md5", &ctx1);
if (err)
{
/* this path is possible under low-memory circumstances */
px_md_free(ctx);
return NULL;
}
/* The password first, since that is what is most unknown */ /* The password first, since that is what is most unknown */
px_md_update(ctx, (const uint8 *) pw, strlen(pw)); px_md_update(ctx, (const uint8 *) pw, strlen(pw));