From: | Noah Misch <noah(at)leadboat(dot)com> |
---|---|
To: | pgsql-committers(at)postgresql(dot)org |
Subject: | pgsql: Fix handling of wide datetime input/output. |
Date: | 2014-02-17 15:05:47 |
Message-ID: | E1WFPlT-0000ho-Rs@gemulon.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers |
Fix handling of wide datetime input/output.
Many server functions use the MAXDATELEN constant to size a buffer for
parsing or displaying a datetime value. It was much too small for the
longest possible interval output and slightly too small for certain
valid timestamp input, particularly input with a long timezone name.
The long input was rejected needlessly; the long output caused
interval_out() to overrun its buffer. ECPG's pgtypes library has a copy
of the vulnerable functions, which bore the same vulnerabilities along
with some of its own. In contrast to the server, certain long inputs
caused stack overflow rather than failing cleanly. Back-patch to 8.4
(all supported versions).
Reported by Daniel Schüssler, reviewed by Tom Lane.
Security: CVE-2014-0063
Branch
------
REL9_0_STABLE
Details
-------
http://git.postgresql.org/pg/commitdiff/b9c3bb1b320afadbf292c408d213b48b1655072c
Modified Files
--------------
src/include/utils/datetime.h | 17 +++++---
src/interfaces/ecpg/pgtypeslib/datetime.c | 4 +-
src/interfaces/ecpg/pgtypeslib/dt.h | 17 +++++---
src/interfaces/ecpg/pgtypeslib/dt_common.c | 44 ++++++++++++++------
src/interfaces/ecpg/pgtypeslib/interval.c | 2 +-
src/interfaces/ecpg/pgtypeslib/timestamp.c | 2 +-
.../ecpg/test/expected/pgtypeslib-dt_test2.c | 22 +++++++---
.../ecpg/test/expected/pgtypeslib-dt_test2.stdout | 19 +++++++++
src/interfaces/ecpg/test/pgtypeslib/dt_test2.pgc | 10 +++++
src/test/regress/expected/interval.out | 7 ++++
src/test/regress/sql/interval.sql | 2 +
11 files changed, 111 insertions(+), 35 deletions(-)
From | Date | Subject | |
---|---|---|---|
Next Message | Noah Misch | 2014-02-17 15:05:48 | pgsql: Document security implications of check_function_bodies. |
Previous Message | Noah Misch | 2014-02-17 15:05:46 | pgsql: Predict integer overflow to avoid buffer overruns. |