database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-25 21:42:33 +03:00
Code

Fix sscanf limits in pg_dump

Browse Source 
Make sure that the string parsing is limited by the size of the
destination buffer.

The buffer is bounded by MAXPGPATH, and thus the limit must be
inserted via preprocessor expansion and the buffer increased by
one to account for the terminator. There is no risk of overflow
here, since in this case, the buffer scanned is smaller than the
destination buffer.

Backpatch all the way down to 9.6.

Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/B14D3D7B-F98C-4E20-9459-C122C67647FB@yesql.se
Backpatch-through: 9.6
This commit is contained in:
Daniel Gustafsson 2021-10-19 12:59:50 +02:00
parent d36bdc4e9d
commit abdf81a20b
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/bin/pg_dump/pg_backup_directory.c
View File

@ -458,11 +458,11 @@ _LoadBlobs(ArchiveHandle *AH)
/* Read the blobs TOC file line-by-line, and process each blob */
while ((cfgets(ctx->blobsTocFH, line, MAXPGPATH)) != NULL)
{
char fname[MAXPGPATH];
char fname[MAXPGPATH + 1];
char path[MAXPGPATH];
/* Can't overflow because line and fname are the same length. */
if (sscanf(line, "%u %s\n", &oid, fname) != 2)
if (sscanf(line, "%u %" CppAsString2(MAXPGPATH) "s\n", &oid, fname) != 2)
exit_horribly(modulename, "invalid line in large object TOC file \"%s\": \"%s\"\n",
fname, line);