Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit969ab9d

Browse files
committed
Follow-up fixes for SHA-2 patch (commit749a9e2).
This changes the check for valid characters in the salt string toonly allow plain ASCII letters and digits. The previous coding waslocale-dependent which doesn't really seem like a great idea here;moreover it could not work correctly in multibyte encodings.This fixes a careless pointer-use-after-pfree, too.Reported-by: Tom Lane <tgl@sss.pgh.pa.us>Reported-by: Andres Freund <andres@anarazel.de>Author: Bernd Helmle <mailings@oopsware.de>Discussion:https://postgr.es/m/6fab35422df6b6b9727fdcc243c5fa1c667dd3b5.camel@oopsware.de
1 parentb73e6d7 commit969ab9d

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

‎contrib/pgcrypto/crypt-sha.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
#include"postgres.h"
4747

4848
#include"common/string.h"
49+
#include"mb/pg_wchar.h"
4950
#include"miscadmin.h"
5051

5152
#include"px-crypt.h"
@@ -58,7 +59,7 @@ typedef enum
5859
PGCRYPTO_SHA_UNKOWN
5960
}PGCRYPTO_SHA_t;
6061

61-
staticunsignedchar_crypt_itoa64[64+1]=
62+
staticconstchar_crypt_itoa64[64+1]=
6263
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
6364

6465
/*
@@ -321,10 +322,13 @@ px_crypt_shacrypt(const char *pw, const char *salt, char *passwd, unsigned dstle
321322

322323
if (*ep!='$')
323324
{
324-
if (isalpha(*ep)||isdigit(*ep)|| (*ep=='.')|| (*ep=='/'))
325+
if (strchr(_crypt_itoa64,*ep)!=NULL)
325326
appendStringInfoCharMacro(decoded_salt,*ep);
326327
else
327-
elog(ERROR,"invalid character in salt string: \"%c\"",*ep);
328+
ereport(ERROR,
329+
errcode(ERRCODE_INVALID_PARAMETER_VALUE),
330+
errmsg("invalid character in salt string: \"%.*s\"",
331+
pg_mblen(ep),ep));
328332
}
329333
else
330334
{
@@ -602,8 +606,6 @@ px_crypt_shacrypt(const char *pw, const char *salt, char *passwd, unsigned dstle
602606
elog(ERROR,"unsupported digest length");
603607
}
604608

605-
*cp='\0';
606-
607609
/*
608610
* Copy over result to specified buffer.
609611
*

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp