database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-29 10:41:53 +03:00
Code Activity

With GB18030, prevent SIGSEGV from reading past end of allocation.

Browse Source 
With GB18030 as source encoding, applications could crash the server via
SQL functions convert() or convert_from().  Applications themselves
could crash after passing unterminated GB18030 input to libpq functions
PQescapeLiteral(), PQescapeIdentifier(), PQescapeStringConn(), or
PQescapeString().  Extension code could crash by passing unterminated
GB18030 input to jsonapi.h functions.  All those functions have been
intended to handle untrusted, unterminated input safely.

A crash required allocating the input such that the last byte of the
allocation was the last byte of a virtual memory page.  Some malloc()
implementations take measures against that, making the SIGSEGV hard to
reach.  Back-patch to v13 (all supported versions).

Author: Noah Misch <noah@leadboat.com>
Author: Andres Freund <andres@anarazel.de>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 13
Security: CVE-2025-4207
This commit is contained in:
Noah Misch
2025-05-05 04:52:04 -07:00
parent 258cde839d
commit 3f2ab73934
9 changed files with 188 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/interfaces/libpq/fe-misc.c
View File

@ -1180,13 +1180,9 @@ pqSocketPoll(int sock, int forRead, int forWrite, time_t end_time)
*/
/*
* Returns the byte length of the character beginning at s, using the
* specified encoding.
*
* Caution: when dealing with text that is not certainly valid in the
* specified encoding, the result may exceed the actual remaining
* string length. Callers that are not prepared to deal with that
* should use PQmblenBounded() instead.
* Like pg_encoding_mblen(). Use this in callers that want the
* dynamically-linked libpq's stance on encodings, even if that means
* different behavior in different startups of the executable.
*/
int
PQmblen(const char *s, int encoding)
@ -1195,8 +1191,9 @@ PQmblen(const char *s, int encoding)
}
/*
* Returns the byte length of the character beginning at s, using the
* specified encoding; but not more than the distance to end of string.
* Like pg_encoding_mblen_bounded(). Use this in callers that want the
* dynamically-linked libpq's stance on encodings, even if that means
* different behavior in different startups of the executable.
*/
int
PQmblenBounded(const char *s, int encoding)