mirror of
https://github.com/postgres/postgres.git
synced 2026-10-23 13:29:09 +03:00
3fb66d3022
The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14
57 lines
1.6 KiB
Makefile
57 lines
1.6 KiB
Makefile
#-------------------------------------------------------------------------
|
|
#
|
|
# Makefile for src/test
|
|
#
|
|
# Copyright (c) 1994, Regents of the University of California
|
|
#
|
|
# src/test/Makefile
|
|
#
|
|
#-------------------------------------------------------------------------
|
|
|
|
subdir = src/test
|
|
top_builddir = ../..
|
|
include $(top_builddir)/src/Makefile.global
|
|
|
|
SUBDIRS = perl postmaster regress isolation modules authentication recovery subscription
|
|
|
|
ifeq ($(with_icu),yes)
|
|
SUBDIRS += icu
|
|
endif
|
|
|
|
# Test suites that are not safe by default but can be run if selected
|
|
# by the user via the whitespace-separated list in variable
|
|
# PG_TEST_EXTRA:
|
|
ifeq ($(with_gssapi),yes)
|
|
ifneq (,$(filter kerberos,$(PG_TEST_EXTRA)))
|
|
SUBDIRS += kerberos
|
|
endif
|
|
endif
|
|
ifeq ($(with_ldap),yes)
|
|
ifneq (,$(filter ldap,$(PG_TEST_EXTRA)))
|
|
SUBDIRS += ldap
|
|
endif
|
|
endif
|
|
ifeq ($(with_ssl),openssl)
|
|
ifneq (,$(filter ssl,$(PG_TEST_EXTRA)))
|
|
SUBDIRS += ssl
|
|
endif
|
|
endif
|
|
|
|
# We don't build or execute these by default, but we do want "make
|
|
# clean" etc to recurse into them. (We must filter out those that we
|
|
# have conditionally included into SUBDIRS above, else there will be
|
|
# make confusion.)
|
|
ALWAYS_SUBDIRS = $(filter-out $(SUBDIRS),examples kerberos icu ldap ssl)
|
|
|
|
# We want to recurse to all subdirs for all standard targets, except that
|
|
# installcheck and install should not recurse into the subdirectory "modules".
|
|
|
|
recurse_alldirs_targets := $(filter-out installcheck install, $(standard_targets))
|
|
installable_dirs := $(filter-out modules, $(SUBDIRS))
|
|
|
|
$(call recurse,$(recurse_alldirs_targets))
|
|
$(call recurse,installcheck, $(installable_dirs))
|
|
$(call recurse,install, $(installable_dirs))
|
|
|
|
$(recurse_always)
|