database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-03 09:13:20 +03:00
Code Activity

Avoid returning undefined bytes in chkpass_in().

Browse Source 
We can't really fix the problem that the result is defined to depend on
random(), so it is still going to fail the "unstable input conversion"
test in parse_type.c.  However, we can at least satify valgrind.  (It
looks like this code used to be valgrind-clean, actually, until somebody
did a careless s/strncpy/strlcpy/g on it.)

In passing, let's just make real sure that chkpass_out doesn't overrun
its output buffer.

No need for backpatch, I think, since this is just to satisfy debugging
tools.

Asif Naeem
This commit is contained in:
Tom Lane
2015-02-14 12:20:56 -05:00
parent 33e879c4e9
commit 80986e85aa
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
contrib/chkpass/chkpass.c
View File

@@ -65,7 +65,7 @@ chkpass_in(PG_FUNCTION_ARGS)
/* special case to let us enter encrypted passwords */ /* special case to let us enter encrypted passwords */
if (*str == ':') if (*str == ':')
{ {
result = (chkpass *) palloc(sizeof(chkpass)); result = (chkpass *) palloc0(sizeof(chkpass));
strlcpy(result->password, str + 1, 13 + 1); strlcpy(result->password, str + 1, 13 + 1);
PG_RETURN_POINTER(result); PG_RETURN_POINTER(result);
} }
@@ -75,7 +75,7 @@ chkpass_in(PG_FUNCTION_ARGS)
(errcode(ERRCODE_DATA_EXCEPTION), (errcode(ERRCODE_DATA_EXCEPTION),
errmsg("password \"%s\" is weak", str))); errmsg("password \"%s\" is weak", str)));
result = (chkpass *) palloc(sizeof(chkpass)); result = (chkpass *) palloc0(sizeof(chkpass));
mysalt[0] = salt_chars[random() & 0x3f]; mysalt[0] = salt_chars[random() & 0x3f];
mysalt[1] = salt_chars[random() & 0x3f]; mysalt[1] = salt_chars[random() & 0x3f];
@@ -107,7 +107,7 @@ chkpass_out(PG_FUNCTION_ARGS)
result = (char *) palloc(16); result = (char *) palloc(16);
result[0] = ':'; result[0] = ':';
strcpy(result + 1, password->password); strlcpy(result + 1, password->password, 15);
PG_RETURN_CSTRING(result); PG_RETURN_CSTRING(result);
} }