pgsql: Guard against enormously long input in pg_saslprep().

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Guard against enormously long input in pg_saslprep().
Date: 2024-10-28 18:39:09
Message-ID: E1t5Udy-002snT-C8@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Guard against enormously long input in pg_saslprep().

Coverity complained that pg_saslprep() could suffer integer overflow,
leading to under-allocation of the output buffer, if the input string
exceeds SIZE_MAX/4. This hazard seems largely hypothetical, but it's
easy enough to defend against, so let's do so.

This patch creates a third place in src/common/ where we are locally
defining MaxAllocSize so that we can test against that in the same way
in backend and frontend compiles. That seems like about two places
too many, so the next patch will move that into common/fe_memutils.h.
I'm hesitant to do that in back branches however.

Back-patch to v14. The code looks similar in older branches, but
before commit 67a472d71 there was a separate test on the input string
length that prevented this hazard.

Per Coverity report.

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/16ebf4f9714a2b8f7f17c537743046a9a59c801b

Modified Files
--------------
src/common/saslprep.c | 7 +++++++
1 file changed, 7 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Alexander Korotkov 2024-10-28 19:42:52 Re: pgsql: Implement pg_wal_replay_wait() stored procedure
Previous Message Alexander Korotkov 2024-10-28 18:35:02 Re: pgsql: Implement pg_wal_replay_wait() stored procedure