Skip site navigation (1) Skip section navigation (2)

pgsql: Repair insufficiently careful type checking for SQL-language

From: tgl(at)postgresql(dot)org (Tom Lane)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Repair insufficiently careful type checking for SQL-language
Date: 2007-02-02 00:02:55
Message-ID: 20070202000255.538969FB26A@postgresql.org (view raw or flat)
Thread:
Lists: pgsql-committers
Log Message:
-----------
Repair insufficiently careful type checking for SQL-language functions:
we should check that the function code returns the claimed result datatype
every time we parse the function for execution.  Formerly, for simple
scalar result types we assumed the creation-time check was sufficient, but
this fails if the function selects from a table that's been redefined since
then, and even more obviously fails if check_function_bodies had been OFF.

This is a significant security hole: not only can one trivially crash the
backend, but with appropriate misuse of pass-by-reference datatypes it is
possible to read out arbitrary locations in the server process's memory,
which could allow retrieving database content the user should not be able
to see.  Our thanks to Jeff Trout for the initial report.

Security: CVE-2007-0555

Modified Files:
--------------
    pgsql/src/backend/executor:
        functions.c (r1.109 -> r1.110)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/executor/functions.c.diff?r1=1.109&r2=1.110)
    pgsql/src/backend/optimizer/util:
        clauses.c (r1.232 -> r1.233)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/optimizer/util/clauses.c.diff?r1=1.232&r2=1.233)

pgsql-committers by date

Next:From: Tom LaneDate: 2007-02-02 00:03:30
Subject: pgsql: Repair insufficiently careful type checking for SQL-language
Previous:From: Tom LaneDate: 2007-02-01 22:06:14
Subject: pgsql: Fix broken markup.

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group