pgsql: Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on

From: tgl(at)postgresql(dot)org (Tom Lane)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on
Date: 2007-01-24 17:12:47
Message-ID: 20070124171247.E3B2A9FB622@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log Message:
-----------
Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on the same
page about the maximum UTF8 sequence length we support (4 bytes since 8.1,
3 before that). pg_utf2wchar_with_len never got updated to support 4-byte
characters at all, and in any case had a buffer-overrun risk in that it
could produce multiple pg_wchars from what mblen claims to be just one UTF8
character. The only reason we don't have a major security hole is that most
callers allocate worst-case output buffers; the sole exception in released
versions appears to be pre-8.2 iwchareq() (ie, ILIKE), which can be crashed
due to zeroing out its return address --- but AFAICS that can't be exploited
for anything more than a crash, due to inability to control what gets written
there. Per report from James Russell and Michael Fuhr.

Pre-8.1 the risk is much less, but I still think pg_utf2wchar_with_len's
behavior given an incomplete final character risks buffer overrun, so
back-patch that logic change anyway.

This patch also makes sure that UTF8 sequences exceeding the supported
length (whichever it is) are consistently treated as error cases, rather
than being treated like a valid shorter sequence in some places.

Tags:
----
REL7_3_STABLE

Modified Files:
--------------
pgsql/src/backend/utils/mb:
wchar.c (r1.30.2.3 -> r1.30.2.4)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/mb/wchar.c.diff?r1=1.30.2.3&r2=1.30.2.4)

Browse pgsql-committers by date

  From Date Subject
Next Message Bruce Momjian 2007-01-24 19:24:28 pgsql: When using MSVC, disable the building of ecpg if pthreads is not
Previous Message Tom Lane 2007-01-24 17:12:41 pgsql: Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on