pgsql: Prevent stack overflow in json-related functions.

From: Noah Misch <noah(at)leadboat(dot)com>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Prevent stack overflow in json-related functions.
Date: 2015-10-05 14:09:49
Message-ID: E1Zj6Sb-0005d0-3k@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Prevent stack overflow in json-related functions.

Sufficiently-deep recursion heretofore elicited a SIGSEGV. If an
application constructs PostgreSQL json or jsonb values from arbitrary
user input, application users could have exploited this to terminate all
active database connections. That applies to 9.3, where the json parser
adopted recursive descent, and later versions. Only row_to_json() and
array_to_json() were at risk in 9.2, both in a non-security capacity.
Back-patch to 9.2, where the json type was introduced.

Oskari Saarenmaa, reviewed by Michael Paquier.

Security: CVE-2015-5289

Branch
------
REL9_5_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/98f30d2e55d530ff47b2756b395a2048200a5ea4

Modified Files
--------------
src/backend/utils/adt/json.c | 6 ++++++
src/backend/utils/adt/jsonb.c | 2 ++
src/backend/utils/adt/jsonfuncs.c | 2 ++
src/test/regress/expected/json.out | 9 +++++++++
src/test/regress/expected/json_1.out | 9 +++++++++
src/test/regress/expected/jsonb.out | 9 +++++++++
src/test/regress/expected/jsonb_1.out | 9 +++++++++
src/test/regress/sql/json.sql | 6 ++++++
src/test/regress/sql/jsonb.sql | 6 ++++++
9 files changed, 58 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Stephen Frost 2015-10-05 14:15:00 pgsql: Add regression tests for INSERT/UPDATE+RETURNING
Previous Message Tom Lane 2015-10-05 13:51:31 Re: [COMMITTERS] pgsql: Lower *_freeze_max_age minimum values.