mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-01-24 18:55:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug in SET SESSION AUTHORIZATION that allows unprivileged users to crash

Browse Source 
the server, if it has been compiled with Asserts enabled (CVE-2006-0553).
Thanks to Akio Ishida for reporting this problem.
This commit is contained in:
Tom Lane 2006-02-12 22:33:14 +00:00
parent 9bb401cd73
commit df2c740c94
4 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/commands/variable.c
View File

@ -9,7 +9,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.105.4.2 2005/08/08 23:39:14 tgl Exp $ * $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.105.4.3 2006/02/12 22:33:14 tgl Exp $
* *
*------------------------------------------------------------------------- *-------------------------------------------------------------------------
*/ */
@ -619,7 +619,9 @@ assign_client_encoding(const char *value, bool doit, GucSource source)
* by the numeric userid, followed by a comma, followed by the user name. * by the numeric userid, followed by a comma, followed by the user name.
* This cannot be confused with a plain user name because of the NAMEDATALEN * This cannot be confused with a plain user name because of the NAMEDATALEN
* limit on names, so we can tell whether we're being passed an initial * limit on names, so we can tell whether we're being passed an initial
* username or a saved/restored value. * username or a saved/restored value. (NOTE: we rely on guc.c to have
* properly truncated any incoming value, but not to truncate already-stored
* values. See GUC_IS_NAME processing.)
*/ */
extern char *session_authorization_string; /* in guc.c */ extern char *session_authorization_string; /* in guc.c */

4
src/backend/utils/mb/encnames.c
View File

@ -2,7 +2,7 @@
* Encoding names and routines for work with it. All * Encoding names and routines for work with it. All
* in this file is shared bedween FE and BE. * in this file is shared bedween FE and BE.
* *
* $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.22 2004/12/04 18:19:31 momjian Exp $ * $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.22.4.1 2006/02/12 22:33:14 tgl Exp $
*/ */
#ifdef FRONTEND #ifdef FRONTEND
#include "postgres_fe.h" #include "postgres_fe.h"
@ -434,7 +434,7 @@ pg_char_to_encname_struct(const char *name)
if (name == NULL || *name == '\0') if (name == NULL || *name == '\0')
return NULL; return NULL;
if (strlen(name) > NAMEDATALEN) if (strlen(name) >= NAMEDATALEN)
{ {
#ifdef FRONTEND #ifdef FRONTEND
fprintf(stderr, "encoding name too long\n"); fprintf(stderr, "encoding name too long\n");

18
src/backend/utils/misc/guc.c
View File

@ -10,7 +10,7 @@
* Written by Peter Eisentraut <peter_e@gmx.net>. * Written by Peter Eisentraut <peter_e@gmx.net>.
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.252.4.2 2005/10/20 20:06:03 tgl Exp $ * $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.252.4.3 2006/02/12 22:33:14 tgl Exp $
* *
*-------------------------------------------------------------------- *--------------------------------------------------------------------
*/ */
@ -44,6 +44,7 @@
#include "optimizer/prep.h" #include "optimizer/prep.h"
#include "parser/parse_expr.h" #include "parser/parse_expr.h"
#include "parser/parse_relation.h" #include "parser/parse_relation.h"
#include "parser/scansup.h"
#include "postmaster/bgwriter.h" #include "postmaster/bgwriter.h"
#include "postmaster/syslogger.h" #include "postmaster/syslogger.h"
#include "postmaster/postmaster.h" #include "postmaster/postmaster.h"
@ -1426,7 +1427,7 @@ static struct config_string ConfigureNamesString[] =
{"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE, {"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE,
gettext_noop("Sets the client's character set encoding."), gettext_noop("Sets the client's character set encoding."),
NULL, NULL,
GUC_REPORT GUC_IS_NAME | GUC_REPORT
}, },
&client_encoding_string, &client_encoding_string,
"SQL_ASCII", assign_client_encoding, NULL "SQL_ASCII", assign_client_encoding, NULL
@ -1506,7 +1507,8 @@ static struct config_string ConfigureNamesString[] =
{ {
{"default_tablespace", PGC_USERSET, CLIENT_CONN_STATEMENT, {"default_tablespace", PGC_USERSET, CLIENT_CONN_STATEMENT,
gettext_noop("Sets the default tablespace to create tables and indexes in."), gettext_noop("Sets the default tablespace to create tables and indexes in."),
gettext_noop("An empty string selects the database's default tablespace.") gettext_noop("An empty string selects the database's default tablespace."),
GUC_IS_NAME
}, },
&default_tablespace, &default_tablespace,
"", assign_default_tablespace, NULL "", assign_default_tablespace, NULL
@ -1646,7 +1648,7 @@ static struct config_string ConfigureNamesString[] =
{"server_encoding", PGC_INTERNAL, CLIENT_CONN_LOCALE, {"server_encoding", PGC_INTERNAL, CLIENT_CONN_LOCALE,
gettext_noop("Sets the server (database) character set encoding."), gettext_noop("Sets the server (database) character set encoding."),
NULL, NULL,
GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE GUC_IS_NAME | GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
}, },
&server_encoding_string, &server_encoding_string,
"SQL_ASCII", NULL, NULL "SQL_ASCII", NULL, NULL
@ -1668,7 +1670,7 @@ static struct config_string ConfigureNamesString[] =
{"session_authorization", PGC_USERSET, UNGROUPED, {"session_authorization", PGC_USERSET, UNGROUPED,
gettext_noop("Sets the session user name."), gettext_noop("Sets the session user name."),
NULL, NULL,
GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE GUC_IS_NAME | GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
}, },
&session_authorization_string, &session_authorization_string,
NULL, assign_session_authorization, show_session_authorization NULL, assign_session_authorization, show_session_authorization
@ -3644,6 +3646,12 @@ set_config_option(const char *name, const char *value,
newval = guc_strdup(elevel, value); newval = guc_strdup(elevel, value);
if (newval == NULL) if (newval == NULL)
return false; return false;
/*
* The only sort of "parsing" check we need to do is
* apply truncation if GUC_IS_NAME.
*/
if (conf->gen.flags & GUC_IS_NAME)
truncate_identifier(newval, strlen(newval), true);
} }
else if (conf->reset_val) else if (conf->reset_val)
{ {

3
src/include/utils/guc_tables.h
View File

@ -7,7 +7,7 @@
* *
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group * Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
* *
* $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19 2004/12/31 22:03:46 pgsql Exp $ * $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19.4.1 2006/02/12 22:33:14 tgl Exp $
* *
*------------------------------------------------------------------------- *-------------------------------------------------------------------------
*/ */
@ -125,6 +125,7 @@ struct config_generic
#define GUC_DISALLOW_IN_FILE 0x0040 /* can't set in postgresql.conf */ #define GUC_DISALLOW_IN_FILE 0x0040 /* can't set in postgresql.conf */
#define GUC_CUSTOM_PLACEHOLDER 0x0080 /* placeholder for custom variable */ #define GUC_CUSTOM_PLACEHOLDER 0x0080 /* placeholder for custom variable */
#define GUC_SUPERUSER_ONLY 0x0100 /* show only to superusers */ #define GUC_SUPERUSER_ONLY 0x0100 /* show only to superusers */
#define GUC_IS_NAME 0x0200 /* limit string to NAMEDATALEN-1 */
/* bit values in status field */ /* bit values in status field */
#define GUC_HAVE_TENTATIVE 0x0001 /* tentative value is defined */ #define GUC_HAVE_TENTATIVE 0x0001 /* tentative value is defined */