Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3344582

Browse files
committed
Fix double-free bug in GSS authentication.
The logic to free the buffer after the gss_init_sec_context() call wasalways a bit wonky. Because gss_init_sec_context() sets the GSS contextvariable, conn->gctx, we would in fact always attempt to free the buffer.That only works, because previously conn->ginbuf.value was initialized toNULL, and free(NULL) is a no-op. Commit61bf96c refactored things sothat the GSS input token buffer is allocated locally in pg_GSS_continue,and not held in the PGconn object. After that, the now-local ginbuf.valuevariable isn't initialized when it's not used, so we pass a bogus pointerto free().To fix, only try to free the input buffer if we allocated it. That was theintention, certainly after the refactoring, and probably even before that.But because there's no live bug before the refactoring, I refrained frombackpatching this.The bug was also independently reported by Graham Dutton, as bug #14690.Patch reviewed by Michael Paquier.Discussion:https://www.postgresql.org/message-id/6288d80e-a0bf-d4d3-4e12-7b79c77f1771%40iki.fiDiscussion:https://www.postgresql.org/message-id/20170605130954.1438.90535%40wrigleys.postgresql.org
1 parentd4bfc06 commit3344582

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

‎src/interfaces/libpq/fe-auth.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,11 @@ pg_GSS_continue(PGconn *conn, int payloadlen)
133133
returnSTATUS_ERROR;
134134
}
135135
}
136+
else
137+
{
138+
ginbuf.length=0;
139+
ginbuf.value=NULL;
140+
}
136141

137142
maj_stat=gss_init_sec_context(&min_stat,
138143
GSS_C_NO_CREDENTIAL,
@@ -142,13 +147,13 @@ pg_GSS_continue(PGconn *conn, int payloadlen)
142147
GSS_C_MUTUAL_FLAG,
143148
0,
144149
GSS_C_NO_CHANNEL_BINDINGS,
145-
(conn->gctx==GSS_C_NO_CONTEXT) ?GSS_C_NO_BUFFER :&ginbuf,
150+
(ginbuf.value==NULL) ?GSS_C_NO_BUFFER :&ginbuf,
146151
NULL,
147152
&goutbuf,
148153
NULL,
149154
NULL);
150155

151-
if (conn->gctx!=GSS_C_NO_CONTEXT)
156+
if (ginbuf.value)
152157
free(ginbuf.value);
153158

154159
if (goutbuf.length!=0)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp