database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Harden PL/Perl code against "tied" Perl arrays and hashes.

Browse Source 
Tied arrays might report different sizes each time they are inspected.
To avoid generating a corrupt result array, fix plperl_array_to_datum()
to read av_len() of each input array only once.  If the input does
appear to get shorter, we'll fill nulls for the now-missing entries,
which seems fine.  Conversely, if it gets longer, we'll ignore the new
entries.

plperl_to_hstore() assumed that Perl's hv_iterinit() returns the
number of entries in the given Perl hash.  Usually that's true,
but per the Perl docs, "the return value is currently only meaningful
for hashes without tie magic".  That could potentially end in a memory
stomp.  We don't depend on that result value anywhere else, so don't
do so here either.

Reported-by: Hcamael <baiyjrh@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Andrew Dunstan <andrew@dunslane.net>
Backpatch-through: 14
Security: CVE-2026-14670
This commit is contained in:
Tom Lane
2026-08-10 06:38:23 -07:00
committed by Noah Misch
parent 3179253c20
commit 477a6bdb08
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
contrib/hstore_plperl/hstore_plperl.c
View File

@@ -125,8 +125,9 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
errmsg("cannot transform non-hash Perl value to hstore")));
hv = (HV *) in;
pcount = hv_iterinit(hv);
(void) hv_iterinit(hv);
pcount = 64; /* arbitrary initial guess */
pairs = palloc_array(Pairs, pcount);
i = 0;
@@ -135,6 +136,12 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
char *key = sv2cstr(HeSVKEY_force(he));
SV *value = HeVAL(he);
if (i >= pcount)
{
pcount *= 2;
pairs = repalloc_array(pairs, Pairs, pcount);
}
pairs[i].key = pstrdup(key);
pairs[i].keylen = hstoreCheckKeyLen(strlen(pairs[i].key));
pairs[i].needfree = true;
@@ -155,7 +162,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
i++;
}
pcount = hstoreUniquePairs(pairs, pcount, &buflen);
pcount = hstoreUniquePairs(pairs, i, &buflen);
out = hstorePairs(pairs, pcount, buflen);
PG_RETURN_POINTER(out);
}

6
src/pl/plperl/plperl.c
View File

@@ -1165,6 +1165,10 @@ get_perl_array_ref(SV *sv)
* if we didn't do it like that, we'd need some other convention for knowing
* whether we'd already found any scalars (and thus the number of dimensions
* is frozen).
*
* Caller is required to have set dims[cur_depth - 1] to the length of the
* input array, i.e., av_len(av) + 1. We make this requirement so as to
* avoid reading av_len() twice, which is hazardous for tied arrays.
*/
static void
array_to_datum_internal(AV *av, ArrayBuildState **astatep,
@@ -1174,7 +1178,7 @@ array_to_datum_internal(AV *av, ArrayBuildState **astatep,
{
dTHX;
int i;
int len = av_len(av) + 1;
int len = dims[cur_depth - 1];
for (i = 0; i < len; i++)
{