database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-11-06 07:49:08 +03:00
Code Activity

Require update permission for the large object written by lo_put().

Browse Source 
lo_put() surely should require UPDATE permission, the same as lowrite(),
but it failed to check for that, as reported by Chapman Flack.  Oversight
in commit c50b7c09d; backpatch to 9.4 where that was introduced.

Tom Lane and Michael Paquier

Security: CVE-2017-7548
This commit is contained in:
Tom Lane
2017-08-07 10:19:01 -04:00
parent e568e1eee4
commit 8d9881911f
3 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/backend/libpq/be-fsstubs.c
View File

@@ -896,6 +896,18 @@ be_lo_put(PG_FUNCTION_ARGS)
CreateFSContext();
loDesc = inv_open(loOid, INV_WRITE, fscxt);
/* Permission check */
if (!lo_compat_privileges &&
pg_largeobject_aclcheck_snapshot(loDesc->id,
GetUserId(),
ACL_UPDATE,
loDesc->snapshot) != ACLCHECK_OK)
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("permission denied for large object %u",
loDesc->id)));
inv_seek(loDesc, offset, SEEK_SET);
written = inv_write(loDesc, VARDATA_ANY(str), VARSIZE_ANY_EXHDR(str));
Assert(written == VARSIZE_ANY_EXHDR(str));