Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1d7641d

Browse files
Fix sscanf limits in pg_basebackup and pg_dump
Make sure that the string parsing is limited by the size of thedestination buffer.In pg_basebackup the available values sent from the serveris limited to two characters so there was no risk of overflow.In pg_dump the buffer is bounded by MAXPGPATH, and thus the limitmust be inserted via preprocessor expansion and the buffer increasedby one to account for the terminator. There is no risk of overflowhere, since in this case, the buffer scanned is smaller than thedestination buffer.Backpatch the pg_basebackup fix to 11 where it was introduced, andthe pg_dump fix all the way down to 9.6.Reviewed-by: Tom LaneDiscussion:https://postgr.es/m/B14D3D7B-F98C-4E20-9459-C122C67647FB@yesql.seBackpatch-through: 11 and 9.6
1 parentfdd8857 commit1d7641d

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

‎src/bin/pg_basebackup/streamutil.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ RetrieveWalSegSize(PGconn *conn)
310310
}
311311

312312
/* fetch xlog value and unit from the result */
313-
if (sscanf(PQgetvalue(res,0,0),"%d%s",&xlog_val,xlog_unit)!=2)
313+
if (sscanf(PQgetvalue(res,0,0),"%d%2s",&xlog_val,xlog_unit)!=2)
314314
{
315315
pg_log_error("WAL segment size could not be parsed");
316316
PQclear(res);

‎src/bin/pg_dump/pg_backup_directory.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -449,11 +449,11 @@ _LoadBlobs(ArchiveHandle *AH)
449449
/* Read the blobs TOC file line-by-line, and process each blob */
450450
while ((cfgets(ctx->blobsTocFH,line,MAXPGPATH))!=NULL)
451451
{
452-
charfname[MAXPGPATH];
452+
charfname[MAXPGPATH+1];
453453
charpath[MAXPGPATH];
454454

455455
/* Can't overflow because line and fname are the same length. */
456-
if (sscanf(line,"%u %s\n",&oid,fname)!=2)
456+
if (sscanf(line,"%u %"CppAsString2(MAXPGPATH)"s\n",&oid,fname)!=2)
457457
fatal("invalid line in large object TOC file \"%s\": \"%s\"",
458458
fname,line);
459459

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp