database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Reject overlong LSN components in START_REPLICATION

Browse Source 
The replication command scanner accepts arbitrarily long hexadecimal
LSN components, but converts them with sscanf("%X/%08X") into uint32
values. An overlong high component can overflow, while an overlong low
component is truncated to its first eight digits. This can cause
START_REPLICATION to use a different WAL location from the one requested.

Use pg_parse_lsn() to validate and convert the complete LSN token,
requiring one to eight hexadecimal digits per component, as for pg_lsn
input. This applies to both physical and logical replication.

Reported-by: ♂π≌26218 <1991230470@qq.com>
Author: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com>
Reviewed-by: Jan Nidzwetzki <jan@planetscale.com>
Reviewed-by: Fujii Masao <masao.fujii@gmail.com>
Discussion: https://postgr.es/m/tencent_C6ED19DF1759CDD37E786F7EE0B5207D0009@qq.com
This commit is contained in:
Fujii Masao
2026-10-22 16:45:06 +09:00
parent 66042bd3eb
commit 4a842a1d65
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/replication/repl_scanner.l
View File

@@ -15,6 +15,7 @@
*/
#include "postgres.h"
#include "common/pg_parse_lsn.h"
#include "nodes/parsenodes.h"
#include "utils/builtins.h"
#include "parser/scansup.h"
@@ -153,11 +154,8 @@ UPLOAD_MANIFEST { return K_UPLOAD_MANIFEST; }
}
{hexdigit}+\/{hexdigit}+ {
uint32 hi,
lo;
if (sscanf(yytext, "%X/%08X", &hi, &lo) != 2)
if (!pg_parse_lsn(yytext, &yylval->recptr))
replication_yyerror(NULL, yyscanner, "invalid streaming start location");
yylval->recptr = ((uint64) hi) << 32 | lo;
return RECPTR;
}

12
src/test/recovery/t/006_logical_decoding.pl
View File

@@ -45,6 +45,18 @@ like(
qr/replication slot "test_slot" was not created in this database/,
"Logical decoding correctly fails to start");
for my $lsn ('123456789/0', '0/123456789')
{
($result, $stdout, $stderr) = $node_primary->psql(
'template1',
qq[START_REPLICATION $lsn],
replication => 'database');
like(
$stderr,
qr/invalid streaming start location/,
"START_REPLICATION rejects overlong LSN $lsn");
}
($result, $stdout, $stderr) = $node_primary->psql(
'template1',
qq[READ_REPLICATION_SLOT test_slot;],