database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-15 03:41:20 +03:00
Code Activity

libpq: Prevent some overflows of int/size_t

Browse Source 
Several functions could overflow their size calculations, when presented
with very large inputs from remote and/or untrusted locations, and then
allocate buffers that were too small to hold the intended contents.

Switch from int to size_t where appropriate, and check for overflow
conditions when the inputs could have plausibly originated outside of
the libpq trust boundary. (Overflows from within the trust boundary are
still possible, but these will be fixed separately.) A version of
add_size() is ported from the backend to assist with code that performs
more complicated concatenation.

Reported-by: Aleksey Solovev (Positive Technologies)
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Security: CVE-2025-12818
Backpatch-through: 13
This commit is contained in:
Jacob Champion
2025-11-10 06:02:34 -08:00
parent 3e0ae46d90
commit 600086f471
5 changed files with 224 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/interfaces/libpq/fe-connect.c
View File

@@ -18,6 +18,7 @@
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>
#include <limits.h>
#include <netdb.h>
#include <time.h>
#include <unistd.h>
@@ -1140,7 +1141,7 @@ parse_comma_separated_list(char **startptr, bool *more)
char *p;
char *s = *startptr;
char *e;
int len;
size_t len;
/*
* Search for the end of the current element; a comma or end-of-string
@@ -5769,7 +5770,21 @@ ldapServiceLookup(const char *purl, PQconninfoOption *options,
/* concatenate values into a single string with newline terminators */
size = 1; /* for the trailing null */
for (i = 0; values[i] != NULL; i++)
{
if (values[i]->bv_len >= INT_MAX ||
size > (INT_MAX - (values[i]->bv_len + 1)))
{
libpq_append_error(errorMessage,
"connection info string size exceeds the maximum allowed (%d)",
INT_MAX);
ldap_value_free_len(values);
ldap_unbind(ld);
return 3;
}
size += values[i]->bv_len + 1;
}
if ((result = malloc(size)) == NULL)
{
libpq_append_error(errorMessage, "out of memory");