2010/3/1 Zdenek Kotala <Zdenek(dot)Kotala(at)sun(dot)com>:
> Magnus Hagander píše v čt 25. 02. 2010 v 15:17 +0100:
>> On Thu, Feb 25, 2010 at 15:04, Zdenek Kotala <Zdenek(dot)Kotala(at)sun(dot)com> wrote:
>> > Hi all,
>> > I got following stack:
>> > fffffd7ffed14b70 strlen () + 40
>> > fffffd7ffed71665 snprintf () + e5
>> > fffffd7fff36d088 pg_GSS_startup () + 88
>> > fffffd7fff36d43a pg_fe_sendauth () + 15a
>> > fffffd7fff36e557 PQconnectPoll () + 3b7
>> > fffffd7fff36e152 connectDBComplete () + a2
>> > fffffd7fff36dc32 PQsetdbLogin () + 1b2
>> > 000000000041e96d main () + 30d
>> > 000000000041302c ???????? ()
>> > It seems that connection is not fully configured and krbsrvname or pghost is
>> > not filled. Following code in fe-auth.c pg_GSS_startup() causes a crash:
>> > 440 maxlen = NI_MAXHOST + strlen(conn->krbsrvname) + 2;
>> > 441 temp_gbuf.value = (char *) malloc(maxlen);
>> > 442 snprintf(temp_gbuf.value, maxlen, "%s(at)%s",
>> > 443 conn->krbsrvname, conn->pghost);
>> > 444 temp_gbuf.length = strlen(temp_gbuf.value);
>> > And following code in fe-connect.c fillPGconn() fill NULL value.
>> > 571 tmp = conninfo_getval(connOptions, "krbsrvname");
>> > 572 conn->krbsrvname = tmp ? strdup(tmp) : NULL;
>> > I think that pg_GSS_startup should sanity the input.
>> How did you get NULL in there? :-)
>> There's a default set for that one that's PG_KRB_SRVNAM, so it really
>> should never come out as NULL, I think...
> Yeah, you are right. conn->krbsrvname is "postgres" and conn->pghost is
Ah, good. We should defentd against that then.
>> As for pghost, that certainly seems to be a bug. We check that one in
>> krb5 and SSPI, but for some reason we seem to be missing it in GSSAPI.
> Yes. The check should be in GSSAPI too.
> However what I see in pg_hba.conf is following line:
> local all all gss
> Gss is used on local unix socket which probably cause a problem that
> conn->pghost is not filled when psql tries to connect.
So there are really two errors - because we should disallow that.
See attached patch - can you confirm it removes the crash with just
the client side applied, and then that it properly rejects GSS with
the server side applied as well?
In response to
pgsql-hackers by date
|Next:||From: Robert Haas||Date: 2010-03-01 16:03:47|
|Subject: Re: contrib/xml2 regression tests vs no-libxslt build option|
|Previous:||From: Tom Lane||Date: 2010-03-01 15:32:32|
|Subject: contrib/xml2 regression tests vs no-libxslt build option|