Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0f7b62f

Browse files
committed
Disallow execution of SPI functions during plperl function compilation.
Perl can be convinced to execute user-defined code during compilationof a plperl function (or at least a plperlu function). That's notsuch a big problem as long as the activity is confined within thePerl interpreter, and it's not clear we could do anything about thatanyway. However, if such code tries to use plperl's SPI functions,we have a bigger problem. In the first place, those functions arelikely to crash because current_call_data->prodesc isn't set up yet.In the second place, because it isn't set up, we lack critical infosuch as whether the function is supposed to be read-only. And inthe third place, this path allows code execution during functionvalidation, which is strongly discouraged because of the potentialfor security exploits. Hence, reject execution of the SPI functionsuntil compilation is finished.While here, add check_spi_usage_allowed() calls to various functionsthat hadn't gotten the memo about checking that. I think that perhapsplperl_sv_to_literal may have been intentionally omitted on the groundsthat it was safe at the time; but if so, the addition of transformsfunctionality changed that. The others are more recently added andseem to be flat-out oversights.Per report from Mark Murawski. Back-patch to all supported branches.Discussion:https://postgr.es/m/9acdf918-7fff-4f40-f750-2ffa84f083d2@intellasoft.net
1 parent5407241 commit0f7b62f

File tree

1 file changed

+31
-2
lines changed

1 file changed

+31
-2
lines changed

‎src/pl/plperl/plperl.c

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,7 @@ static plperl_proc_desc *compile_plperl_function(Oid fn_oid,
265265

266266
staticSV*plperl_hash_from_tuple(HeapTupletuple,TupleDesctupdesc,boolinclude_generated);
267267
staticSV*plperl_hash_from_datum(Datumattr);
268+
staticvoidcheck_spi_usage_allowed(void);
268269
staticSV*plperl_ref_from_pg_array(Datumarg,Oidtypid);
269270
staticSV*split_array(plperl_array_info*info,intfirst,intlast,intnest);
270271
staticSV*make_array_ref(plperl_array_info*info,intfirst,intlast);
@@ -1433,13 +1434,15 @@ plperl_sv_to_datum(SV *sv, Oid typid, int32 typmod,
14331434
char*
14341435
plperl_sv_to_literal(SV*sv,char*fqtypename)
14351436
{
1436-
Datumstr=CStringGetDatum(fqtypename);
1437-
Oidtypid=DirectFunctionCall1(regtypein,str);
1437+
Oidtypid;
14381438
Oidtypoutput;
14391439
Datumdatum;
14401440
booltypisvarlena,
14411441
isnull;
14421442

1443+
check_spi_usage_allowed();
1444+
1445+
typid=DirectFunctionCall1(regtypein,CStringGetDatum(fqtypename));
14431446
if (!OidIsValid(typid))
14441447
ereport(ERROR,
14451448
(errcode(ERRCODE_UNDEFINED_OBJECT),
@@ -3121,6 +3124,21 @@ check_spi_usage_allowed(void)
31213124
/* simple croak as we don't want to involve PostgreSQL code */
31223125
croak("SPI functions can not be used in END blocks");
31233126
}
3127+
3128+
/*
3129+
* Disallow SPI usage if we're not executing a fully-compiled plperl
3130+
* function. It might seem impossible to get here in that case, but there
3131+
* are cases where Perl will try to execute code during compilation. If
3132+
* we proceed we are likely to crash trying to dereference the prodesc
3133+
* pointer. Working around that might be possible, but it seems unwise
3134+
* because it'd allow code execution to happen while validating a
3135+
* function, which is undesirable.
3136+
*/
3137+
if (current_call_data==NULL||current_call_data->prodesc==NULL)
3138+
{
3139+
/* simple croak as we don't want to involve PostgreSQL code */
3140+
croak("SPI functions can not be used during function compilation");
3141+
}
31243142
}
31253143

31263144

@@ -3241,6 +3259,8 @@ plperl_return_next(SV *sv)
32413259
{
32423260
MemoryContextoldcontext=CurrentMemoryContext;
32433261

3262+
check_spi_usage_allowed();
3263+
32443264
PG_TRY();
32453265
{
32463266
plperl_return_next_internal(sv);
@@ -3985,6 +4005,8 @@ plperl_spi_commit(void)
39854005
{
39864006
MemoryContextoldcontext=CurrentMemoryContext;
39874007

4008+
check_spi_usage_allowed();
4009+
39884010
PG_TRY();
39894011
{
39904012
SPI_commit();
@@ -4010,6 +4032,8 @@ plperl_spi_rollback(void)
40104032
{
40114033
MemoryContextoldcontext=CurrentMemoryContext;
40124034

4035+
check_spi_usage_allowed();
4036+
40134037
PG_TRY();
40144038
{
40154039
SPI_rollback();
@@ -4047,6 +4071,11 @@ plperl_util_elog(int level, SV *msg)
40474071
MemoryContextoldcontext=CurrentMemoryContext;
40484072
char*volatilecmsg=NULL;
40494073

4074+
/*
4075+
* We intentionally omit check_spi_usage_allowed() here, as this seems
4076+
* safe to allow even in the contexts that that function rejects.
4077+
*/
4078+
40504079
PG_TRY();
40514080
{
40524081
cmsg=sv2cstr(msg);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp