Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0182438

Browse files
committed
Prevent potential overruns of fixed-size buffers.
Coverity identified a number of places in which it couldn't prove that astring being copied into a fixed-size buffer would fit. We believe thatmost, perhaps all of these are in fact safe, or are copying data that iscoming from a trusted source so that any overrun is not really a securityissue. Nonetheless it seems prudent to forestall any risk by usingstrlcpy() and similar functions.Fixes by Peter Eisentraut and Jozef Mlich based on Coverity reports.In addition, fix a potential null-pointer-dereference crash incontrib/chkpass. The crypt(3) function is defined to return NULL onfailure, but chkpass.c didn't check for that before using the result.The main practical case in which this could be an issue is if libc isconfigured to refuse to execute unapproved hashing algorithms (e.g.,"FIPS mode"). This ideally should've been a separate commit, butsince it touches code adjacent to one of the buffer overrun changes,I included it in this commit to avoid last-minute merge issues.This issue was reported by Honza Horak.Security:CVE-2014-0065 for buffer overruns,CVE-2014-0066 for crypt()
1 parent31400a6 commit0182438

File tree

13 files changed

+46
-29
lines changed

13 files changed

+46
-29
lines changed

‎contrib/chkpass/chkpass.c

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,11 +94,13 @@ chkpass_in(PG_FUNCTION_ARGS)
9494
mysalt[2]=0;/* technically the terminator is not necessary
9595
* but I like to play safe */
9696

97-
if ((crypt_output=crypt(str,mysalt))==NULL)
97+
crypt_output=crypt(str,mysalt);
98+
if (crypt_output==NULL)
9899
ereport(ERROR,
99100
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
100101
errmsg("crypt() failed")));
101-
strcpy(result->password,crypt_output);
102+
103+
strlcpy(result->password,crypt_output,sizeof(result->password));
102104

103105
PG_RETURN_POINTER(result);
104106
}
@@ -148,9 +150,16 @@ chkpass_eq(PG_FUNCTION_ARGS)
148150
chkpass*a1= (chkpass*)PG_GETARG_POINTER(0);
149151
text*a2=PG_GETARG_TEXT_PP(1);
150152
charstr[9];
153+
char*crypt_output;
151154

152155
text_to_cstring_buffer(a2,str,sizeof(str));
153-
PG_RETURN_BOOL(strcmp(a1->password,crypt(str,a1->password))==0);
156+
crypt_output=crypt(str,a1->password);
157+
if (crypt_output==NULL)
158+
ereport(ERROR,
159+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
160+
errmsg("crypt() failed")));
161+
162+
PG_RETURN_BOOL(strcmp(a1->password,crypt_output)==0);
154163
}
155164

156165
PG_FUNCTION_INFO_V1(chkpass_ne);
@@ -160,7 +169,14 @@ chkpass_ne(PG_FUNCTION_ARGS)
160169
chkpass*a1= (chkpass*)PG_GETARG_POINTER(0);
161170
text*a2=PG_GETARG_TEXT_PP(1);
162171
charstr[9];
172+
char*crypt_output;
163173

164174
text_to_cstring_buffer(a2,str,sizeof(str));
165-
PG_RETURN_BOOL(strcmp(a1->password,crypt(str,a1->password))!=0);
175+
crypt_output=crypt(str,a1->password);
176+
if (crypt_output==NULL)
177+
ereport(ERROR,
178+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
179+
errmsg("crypt() failed")));
180+
181+
PG_RETURN_BOOL(strcmp(a1->password,crypt_output)!=0);
166182
}

‎contrib/pg_standby/pg_standby.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ SetWALFileNameForCleanup(void)
327327
if (strcmp(restartWALFileName,nextWALFileName)>0)
328328
return false;
329329

330-
strcpy(exclusiveCleanupFileName,restartWALFileName);
330+
strlcpy(exclusiveCleanupFileName,restartWALFileName,sizeof(exclusiveCleanupFileName));
331331
return true;
332332
}
333333

‎src/backend/access/transam/xlog.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5844,7 +5844,7 @@ recoveryStopsAfter(XLogRecord *record)
58445844
recoveryStopAfter= true;
58455845
recoveryStopXid=InvalidTransactionId;
58465846
(void)getRecordTimestamp(record,&recoveryStopTime);
5847-
strncpy(recoveryStopName,recordRestorePointData->rp_name,MAXFNAMELEN);
5847+
strlcpy(recoveryStopName,recordRestorePointData->rp_name,MAXFNAMELEN);
58485848

58495849
ereport(LOG,
58505850
(errmsg("recovery stopping at restore point \"%s\", time %s",
@@ -6311,7 +6311,7 @@ StartupXLOG(void)
63116311
* Save archive_cleanup_command in shared memory so that other processes
63126312
* can see it.
63136313
*/
6314-
strncpy(XLogCtl->archiveCleanupCommand,
6314+
strlcpy(XLogCtl->archiveCleanupCommand,
63156315
archiveCleanupCommand ?archiveCleanupCommand :"",
63166316
sizeof(XLogCtl->archiveCleanupCommand));
63176317

@@ -9107,7 +9107,7 @@ XLogRestorePoint(const char *rpName)
91079107
xl_restore_pointxlrec;
91089108

91099109
xlrec.rp_time=GetCurrentTimestamp();
9110-
strncpy(xlrec.rp_name,rpName,MAXFNAMELEN);
9110+
strlcpy(xlrec.rp_name,rpName,MAXFNAMELEN);
91119111

91129112
rdata.buffer=InvalidBuffer;
91139113
rdata.data= (char*)&xlrec;

‎src/backend/tsearch/spell.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ NIAddSpell(IspellDict *Conf, const char *word, const char *flag)
255255
}
256256
Conf->Spell[Conf->nspell]= (SPELL*)tmpalloc(SPELLHDRSZ+strlen(word)+1);
257257
strcpy(Conf->Spell[Conf->nspell]->word,word);
258-
strncpy(Conf->Spell[Conf->nspell]->p.flag,flag,MAXFLAGLEN);
258+
strlcpy(Conf->Spell[Conf->nspell]->p.flag,flag,MAXFLAGLEN);
259259
Conf->nspell++;
260260
}
261261

‎src/backend/utils/adt/datetime.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,10 @@ const char *const days[] = {"Sunday", "Monday", "Tuesday", "Wednesday",
8989
* Note that this table must be strictly alphabetically ordered to allow an
9090
* O(ln(N)) search algorithm to be used.
9191
*
92-
* Thetext field is NOT guaranteed to be NULL-terminated.
92+
* Thetoken field is NOT guaranteed to be NULL-terminated.
9393
*
94-
* To keep this table reasonably small, we divide thelexval for TZ and DTZ
95-
* entries by 15 (so they are on 15 minute boundaries) and truncate thetext
94+
* To keep this table reasonably small, we divide thevalue for TZ and DTZ
95+
* entries by 15 (so they are on 15 minute boundaries) and truncate thetoken
9696
* field at TOKMAXLEN characters.
9797
* Formerly, we divided by 10 rather than 15 but there are a few time zones
9898
* which are 30 or 45 minutes away from an even hour, most are on an hour
@@ -107,7 +107,7 @@ static datetkn *timezonetktbl = NULL;
107107
staticintsztimezonetktbl=0;
108108

109109
staticconstdatetkndatetktbl[]= {
110-
/*text, token,lexval */
110+
/* token,type, value */
111111
{EARLY,RESERV,DTK_EARLY},/* "-infinity" reserved for "early time" */
112112
{DA_D,ADBC,AD},/* "ad" for years > 0 */
113113
{"allballs",RESERV,DTK_ZULU},/* 00:00:00 */
@@ -187,7 +187,7 @@ static const datetkn datetktbl[] = {
187187
staticintszdatetktbl=sizeofdatetktbl /sizeofdatetktbl[0];
188188

189189
staticconstdatetkndeltatktbl[]= {
190-
/*text, token, lexval */
190+
/*token, type, value */
191191
{"@",IGNORE_DTF,0},/* postgres relative prefix */
192192
{DAGO,AGO,0},/* "ago" indicates negative time offset */
193193
{"c",UNITS,DTK_CENTURY},/* "century" relative */
@@ -4215,6 +4215,7 @@ ConvertTimeZoneAbbrevs(TimeZoneAbbrevTable *tbl,
42154215
tbl->numabbrevs=n;
42164216
for (i=0;i<n;i++)
42174217
{
4218+
/* do NOT use strlcpy here; token field need not be null-terminated */
42184219
strncpy(newtbl[i].token,abbrevs[i].abbrev,TOKMAXLEN);
42194220
newtbl[i].type=abbrevs[i].is_dst ?DTZ :TZ;
42204221
TOVAL(&newtbl[i],abbrevs[i].offset /MINS_PER_HOUR);

‎src/bin/initdb/findtimezone.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ pg_open_tzfile(const char *name, char *canonname)
6868
if (canonname)
6969
strlcpy(canonname,name,TZ_STRLEN_MAX+1);
7070

71-
strcpy(fullname,pg_TZDIR());
71+
strlcpy(fullname,pg_TZDIR(),sizeof(fullname));
7272
if (strlen(fullname)+1+strlen(name) >=MAXPGPATH)
7373
return-1;/* not gonna fit */
7474
strcat(fullname,"/");
@@ -375,7 +375,7 @@ identify_system_timezone(void)
375375
}
376376

377377
/* Search for the best-matching timezone file */
378-
strcpy(tmptzdir,pg_TZDIR());
378+
strlcpy(tmptzdir,pg_TZDIR(),sizeof(tmptzdir));
379379
bestscore=-1;
380380
resultbuf[0]='\0';
381381
scan_available_timezones(tmptzdir,tmptzdir+strlen(tmptzdir)+1,

‎src/bin/pg_basebackup/pg_basebackup.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -921,9 +921,9 @@ ReceiveAndUnpackTarFile(PGconn *conn, PGresult *res, int rownum)
921921
FILE*file=NULL;
922922

923923
if (basetablespace)
924-
strcpy(current_path,basedir);
924+
strlcpy(current_path,basedir,sizeof(current_path));
925925
else
926-
strcpy(current_path,PQgetvalue(res,rownum,1));
926+
strlcpy(current_path,PQgetvalue(res,rownum,1),sizeof(current_path));
927927

928928
/*
929929
* Get the COPY data
@@ -1454,7 +1454,7 @@ BaseBackup(void)
14541454
disconnect_and_exit(1);
14551455
}
14561456

1457-
strcpy(xlogstart,PQgetvalue(res,0,0));
1457+
strlcpy(xlogstart,PQgetvalue(res,0,0),sizeof(xlogstart));
14581458

14591459
/*
14601460
* 9.3 and later sends the TLI of the starting point. With older servers,
@@ -1565,7 +1565,7 @@ BaseBackup(void)
15651565
progname);
15661566
disconnect_and_exit(1);
15671567
}
1568-
strcpy(xlogend,PQgetvalue(res,0,0));
1568+
strlcpy(xlogend,PQgetvalue(res,0,0),sizeof(xlogend));
15691569
if (verbose&&includewal)
15701570
fprintf(stderr,"transaction log end point: %s\n",xlogend);
15711571
PQclear(res);

‎src/common/exec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ validate_exec(const char *path)
6868
if (strlen(path) >=strlen(".exe")&&
6969
pg_strcasecmp(path+strlen(path)-strlen(".exe"),".exe")!=0)
7070
{
71-
strcpy(path_exe,path);
71+
strlcpy(path_exe,path,sizeof(path_exe)-4);
7272
strcat(path_exe,".exe");
7373
path=path_exe;
7474
}
@@ -277,7 +277,7 @@ resolve_symlinks(char *path)
277277
}
278278

279279
/* must copy final component out of 'path' temporarily */
280-
strcpy(link_buf,fname);
280+
strlcpy(link_buf,fname,sizeof(link_buf));
281281

282282
if (!getcwd(path,MAXPGPATH))
283283
{

‎src/interfaces/ecpg/preproc/pgc.l

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1334,7 +1334,7 @@ parse_include(void)
13341334
yytext[i] ='\0';
13351335
memmove(yytext, yytext+1,strlen(yytext));
13361336

1337-
strncpy(inc_file, yytext,sizeof(inc_file));
1337+
strlcpy(inc_file, yytext,sizeof(inc_file));
13381338
yyin =fopen(inc_file,"r");
13391339
if (!yyin)
13401340
{

‎src/interfaces/libpq/fe-protocol2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -500,7 +500,7 @@ pqParseInput2(PGconn *conn)
500500
if (!conn->result)
501501
return;
502502
}
503-
strncpy(conn->result->cmdStatus,conn->workBuffer.data,
503+
strlcpy(conn->result->cmdStatus,conn->workBuffer.data,
504504
CMDSTATUS_LEN);
505505
checkXactStatus(conn,conn->workBuffer.data);
506506
conn->asyncStatus=PGASYNC_READY;

‎src/interfaces/libpq/fe-protocol3.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ pqParseInput3(PGconn *conn)
206206
if (!conn->result)
207207
return;
208208
}
209-
strncpy(conn->result->cmdStatus,conn->workBuffer.data,
209+
strlcpy(conn->result->cmdStatus,conn->workBuffer.data,
210210
CMDSTATUS_LEN);
211211
conn->asyncStatus=PGASYNC_READY;
212212
break;

‎src/test/regress/pg_regress.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1221,7 +1221,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12211221
*/
12221222
platform_expectfile=get_expectfile(testname,resultsfile);
12231223

1224-
strcpy(expectfile,default_expectfile);
1224+
strlcpy(expectfile,default_expectfile,sizeof(expectfile));
12251225
if (platform_expectfile)
12261226
{
12271227
/*
@@ -1276,7 +1276,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12761276
{
12771277
/* This diff was a better match than the last one */
12781278
best_line_count=l;
1279-
strcpy(best_expect_file,alt_expectfile);
1279+
strlcpy(best_expect_file,alt_expectfile,sizeof(best_expect_file));
12801280
}
12811281
free(alt_expectfile);
12821282
}
@@ -1304,7 +1304,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
13041304
{
13051305
/* This diff was a better match than the last one */
13061306
best_line_count=l;
1307-
strcpy(best_expect_file,default_expectfile);
1307+
strlcpy(best_expect_file,default_expectfile,sizeof(best_expect_file));
13081308
}
13091309
}
13101310

‎src/timezone/pgtz.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ pg_open_tzfile(const char *name, char *canonname)
8383
* Loop to split the given name into directory levels; for each level,
8484
* search using scan_directory_ci().
8585
*/
86-
strcpy(fullname,pg_TZDIR());
86+
strlcpy(fullname,pg_TZDIR(),sizeof(fullname));
8787
orignamelen=fullnamelen=strlen(fullname);
8888
fname=name;
8989
for (;;)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp