Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4741e31

Browse files
committed
Prevent potential overruns of fixed-size buffers.
Coverity identified a number of places in which it couldn't prove that astring being copied into a fixed-size buffer would fit. We believe thatmost, perhaps all of these are in fact safe, or are copying data that iscoming from a trusted source so that any overrun is not really a securityissue. Nonetheless it seems prudent to forestall any risk by usingstrlcpy() and similar functions.Fixes by Peter Eisentraut and Jozef Mlich based on Coverity reports.In addition, fix a potential null-pointer-dereference crash incontrib/chkpass. The crypt(3) function is defined to return NULL onfailure, but chkpass.c didn't check for that before using the result.The main practical case in which this could be an issue is if libc isconfigured to refuse to execute unapproved hashing algorithms (e.g.,"FIPS mode"). This ideally should've been a separate commit, butsince it touches code adjacent to one of the buffer overrun changes,I included it in this commit to avoid last-minute merge issues.This issue was reported by Honza Horak.Security:CVE-2014-0065 for buffer overruns,CVE-2014-0066 for crypt()
1 parent0b7026d commit4741e31

File tree

13 files changed

+51
-27
lines changed

13 files changed

+51
-27
lines changed

‎contrib/chkpass/chkpass.c

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ chkpass_in(PG_FUNCTION_ARGS)
7070
char*str=PG_GETARG_CSTRING(0);
7171
chkpass*result;
7272
charmysalt[4];
73+
char*crypt_output;
7374
staticcharsalt_chars[]=
7475
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
7576

@@ -92,7 +93,15 @@ chkpass_in(PG_FUNCTION_ARGS)
9293
mysalt[1]=salt_chars[random()&0x3f];
9394
mysalt[2]=0;/* technically the terminator is not necessary
9495
* but I like to play safe */
95-
strcpy(result->password,crypt(str,mysalt));
96+
97+
crypt_output=crypt(str,mysalt);
98+
if (crypt_output==NULL)
99+
ereport(ERROR,
100+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
101+
errmsg("crypt() failed")));
102+
103+
strlcpy(result->password,crypt_output,sizeof(result->password));
104+
96105
PG_RETURN_POINTER(result);
97106
}
98107

@@ -141,9 +150,16 @@ chkpass_eq(PG_FUNCTION_ARGS)
141150
chkpass*a1= (chkpass*)PG_GETARG_POINTER(0);
142151
text*a2=PG_GETARG_TEXT_PP(1);
143152
charstr[9];
153+
char*crypt_output;
144154

145155
text_to_cstring_buffer(a2,str,sizeof(str));
146-
PG_RETURN_BOOL(strcmp(a1->password,crypt(str,a1->password))==0);
156+
crypt_output=crypt(str,a1->password);
157+
if (crypt_output==NULL)
158+
ereport(ERROR,
159+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
160+
errmsg("crypt() failed")));
161+
162+
PG_RETURN_BOOL(strcmp(a1->password,crypt_output)==0);
147163
}
148164

149165
PG_FUNCTION_INFO_V1(chkpass_ne);
@@ -153,7 +169,14 @@ chkpass_ne(PG_FUNCTION_ARGS)
153169
chkpass*a1= (chkpass*)PG_GETARG_POINTER(0);
154170
text*a2=PG_GETARG_TEXT_PP(1);
155171
charstr[9];
172+
char*crypt_output;
156173

157174
text_to_cstring_buffer(a2,str,sizeof(str));
158-
PG_RETURN_BOOL(strcmp(a1->password,crypt(str,a1->password))!=0);
175+
crypt_output=crypt(str,a1->password);
176+
if (crypt_output==NULL)
177+
ereport(ERROR,
178+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
179+
errmsg("crypt() failed")));
180+
181+
PG_RETURN_BOOL(strcmp(a1->password,crypt_output)!=0);
159182
}

‎contrib/pg_standby/pg_standby.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,7 +338,7 @@ SetWALFileNameForCleanup(void)
338338
if (strcmp(restartWALFileName,nextWALFileName)>0)
339339
return false;
340340

341-
strcpy(exclusiveCleanupFileName,restartWALFileName);
341+
strlcpy(exclusiveCleanupFileName,restartWALFileName,sizeof(exclusiveCleanupFileName));
342342
return true;
343343
}
344344

‎src/backend/access/transam/xlog.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5674,7 +5674,7 @@ recoveryStopsHere(XLogRecord *record, bool *includeThis)
56745674

56755675
recordRestorePointData= (xl_restore_point*)XLogRecGetData(record);
56765676
recordXtime=recordRestorePointData->rp_time;
5677-
strncpy(recordRPName,recordRestorePointData->rp_name,MAXFNAMELEN);
5677+
strlcpy(recordRPName,recordRestorePointData->rp_name,MAXFNAMELEN);
56785678
}
56795679
else
56805680
return false;
@@ -5769,7 +5769,7 @@ recoveryStopsHere(XLogRecord *record, bool *includeThis)
57695769
}
57705770
else
57715771
{
5772-
strncpy(recoveryStopName,recordRPName,MAXFNAMELEN);
5772+
strlcpy(recoveryStopName,recordRPName,MAXFNAMELEN);
57735773

57745774
ereport(LOG,
57755775
(errmsg("recovery stopping at restore point \"%s\", time %s",
@@ -6163,7 +6163,7 @@ StartupXLOG(void)
61636163
* see them
61646164
*/
61656165
XLogCtl->RecoveryTargetTLI=recoveryTargetTLI;
6166-
strncpy(XLogCtl->archiveCleanupCommand,
6166+
strlcpy(XLogCtl->archiveCleanupCommand,
61676167
archiveCleanupCommand ?archiveCleanupCommand :"",
61686168
sizeof(XLogCtl->archiveCleanupCommand));
61696169

@@ -8403,7 +8403,7 @@ XLogRestorePoint(const char *rpName)
84038403
xl_restore_pointxlrec;
84048404

84058405
xlrec.rp_time=GetCurrentTimestamp();
8406-
strncpy(xlrec.rp_name,rpName,MAXFNAMELEN);
8406+
strlcpy(xlrec.rp_name,rpName,MAXFNAMELEN);
84078407

84088408
rdata.buffer=InvalidBuffer;
84098409
rdata.data= (char*)&xlrec;

‎src/backend/tsearch/spell.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ NIAddSpell(IspellDict *Conf, const char *word, const char *flag)
255255
}
256256
Conf->Spell[Conf->nspell]= (SPELL*)tmpalloc(SPELLHDRSZ+strlen(word)+1);
257257
strcpy(Conf->Spell[Conf->nspell]->word,word);
258-
strncpy(Conf->Spell[Conf->nspell]->p.flag,flag,MAXFLAGLEN);
258+
strlcpy(Conf->Spell[Conf->nspell]->p.flag,flag,MAXFLAGLEN);
259259
Conf->nspell++;
260260
}
261261

‎src/backend/utils/adt/datetime.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,10 @@ char *days[] = {"Sunday", "Monday", "Tuesday", "Wednesday",
8989
* Note that this table must be strictly alphabetically ordered to allow an
9090
* O(ln(N)) search algorithm to be used.
9191
*
92-
* Thetext field is NOT guaranteed to be NULL-terminated.
92+
* Thetoken field is NOT guaranteed to be NULL-terminated.
9393
*
94-
* To keep this table reasonably small, we divide thelexval for TZ and DTZ
95-
* entries by 15 (so they are on 15 minute boundaries) and truncate thetext
94+
* To keep this table reasonably small, we divide thevalue for TZ and DTZ
95+
* entries by 15 (so they are on 15 minute boundaries) and truncate thetoken
9696
* field at TOKMAXLEN characters.
9797
* Formerly, we divided by 10 rather than 15 but there are a few time zones
9898
* which are 30 or 45 minutes away from an even hour, most are on an hour
@@ -107,7 +107,7 @@ static datetkn *timezonetktbl = NULL;
107107
staticintsztimezonetktbl=0;
108108

109109
staticconstdatetkndatetktbl[]= {
110-
/*text, token,lexval */
110+
/* token,type, value */
111111
{EARLY,RESERV,DTK_EARLY},/* "-infinity" reserved for "early time" */
112112
{DA_D,ADBC,AD},/* "ad" for years > 0 */
113113
{"allballs",RESERV,DTK_ZULU},/* 00:00:00 */
@@ -187,7 +187,7 @@ static const datetkn datetktbl[] = {
187187
staticintszdatetktbl=sizeofdatetktbl /sizeofdatetktbl[0];
188188

189189
staticdatetkndeltatktbl[]= {
190-
/*text, token, lexval */
190+
/*token, type, value */
191191
{"@",IGNORE_DTF,0},/* postgres relative prefix */
192192
{DAGO,AGO,0},/* "ago" indicates negative time offset */
193193
{"c",UNITS,DTK_CENTURY},/* "century" relative */
@@ -4161,6 +4161,7 @@ ConvertTimeZoneAbbrevs(TimeZoneAbbrevTable *tbl,
41614161
tbl->numabbrevs=n;
41624162
for (i=0;i<n;i++)
41634163
{
4164+
/* do NOT use strlcpy here; token field need not be null-terminated */
41644165
strncpy(newtbl[i].token,abbrevs[i].abbrev,TOKMAXLEN);
41654166
newtbl[i].type=abbrevs[i].is_dst ?DTZ :TZ;
41664167
TOVAL(&newtbl[i],abbrevs[i].offset /MINS_PER_HOUR);

‎src/bin/initdb/initdb.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3242,7 +3242,7 @@ main(int argc, char *argv[])
32423242
fprintf(stderr,"%s",authwarning);
32433243

32443244
/* Get directory specification used to start this executable */
3245-
strcpy(bin_dir,argv[0]);
3245+
strlcpy(bin_dir,argv[0],sizeof(bin_dir));
32463246
get_parent_directory(bin_dir);
32473247

32483248
printf(_("\nSuccess. You can now start the database server using:\n\n"

‎src/bin/pg_basebackup/pg_basebackup.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,7 @@ ReceiveAndUnpackTarFile(PGconn *conn, PGresult *res, int rownum)
508508
FILE*file=NULL;
509509

510510
if (PQgetisnull(res,rownum,0))
511-
strcpy(current_path,basedir);
511+
strlcpy(current_path,basedir,sizeof(current_path));
512512
else
513513
{
514514
if (PQgetlength(res,rownum,1) >=MAXPGPATH)
@@ -517,7 +517,7 @@ ReceiveAndUnpackTarFile(PGconn *conn, PGresult *res, int rownum)
517517
progname,PQgetvalue(res,rownum,1));
518518
disconnect_and_exit(1);
519519
}
520-
strcpy(current_path,PQgetvalue(res,rownum,1));
520+
strlcpy(current_path,PQgetvalue(res,rownum,1),sizeof(current_path));
521521
}
522522

523523
/*

‎src/interfaces/ecpg/preproc/pgc.l

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1314,7 +1314,7 @@ parse_include(void)
13141314
yytext[i] ='\0';
13151315
memmove(yytext, yytext+1,strlen(yytext));
13161316

1317-
strncpy(inc_file, yytext,sizeof(inc_file));
1317+
strlcpy(inc_file, yytext,sizeof(inc_file));
13181318
yyin =fopen(inc_file,"r");
13191319
if (!yyin)
13201320
{

‎src/interfaces/libpq/fe-protocol2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -500,7 +500,7 @@ pqParseInput2(PGconn *conn)
500500
if (!conn->result)
501501
return;
502502
}
503-
strncpy(conn->result->cmdStatus,conn->workBuffer.data,
503+
strlcpy(conn->result->cmdStatus,conn->workBuffer.data,
504504
CMDSTATUS_LEN);
505505
checkXactStatus(conn,conn->workBuffer.data);
506506
conn->asyncStatus=PGASYNC_READY;

‎src/interfaces/libpq/fe-protocol3.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ pqParseInput3(PGconn *conn)
206206
if (!conn->result)
207207
return;
208208
}
209-
strncpy(conn->result->cmdStatus,conn->workBuffer.data,
209+
strlcpy(conn->result->cmdStatus,conn->workBuffer.data,
210210
CMDSTATUS_LEN);
211211
conn->asyncStatus=PGASYNC_READY;
212212
break;

‎src/port/exec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ validate_exec(const char *path)
6666
if (strlen(path) >=strlen(".exe")&&
6767
pg_strcasecmp(path+strlen(path)-strlen(".exe"),".exe")!=0)
6868
{
69-
strcpy(path_exe,path);
69+
strlcpy(path_exe,path,sizeof(path_exe)-4);
7070
strcat(path_exe,".exe");
7171
path=path_exe;
7272
}
@@ -275,7 +275,7 @@ resolve_symlinks(char *path)
275275
}
276276

277277
/* must copy final component out of 'path' temporarily */
278-
strcpy(link_buf,fname);
278+
strlcpy(link_buf,fname,sizeof(link_buf));
279279

280280
if (!getcwd(path,MAXPGPATH))
281281
{

‎src/test/regress/pg_regress.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1242,7 +1242,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12421242
*/
12431243
platform_expectfile=get_expectfile(testname,resultsfile);
12441244

1245-
strcpy(expectfile,default_expectfile);
1245+
strlcpy(expectfile,default_expectfile,sizeof(expectfile));
12461246
if (platform_expectfile)
12471247
{
12481248
/*
@@ -1297,7 +1297,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12971297
{
12981298
/* This diff was a better match than the last one */
12991299
best_line_count=l;
1300-
strcpy(best_expect_file,alt_expectfile);
1300+
strlcpy(best_expect_file,alt_expectfile,sizeof(best_expect_file));
13011301
}
13021302
free(alt_expectfile);
13031303
}
@@ -1325,7 +1325,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
13251325
{
13261326
/* This diff was a better match than the last one */
13271327
best_line_count=l;
1328-
strcpy(best_expect_file,default_expectfile);
1328+
strlcpy(best_expect_file,default_expectfile,sizeof(best_expect_file));
13291329
}
13301330
}
13311331

‎src/timezone/pgtz.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ pg_open_tzfile(const char *name, char *canonname)
9494
* Loop to split the given name into directory levels; for each level,
9595
* search using scan_directory_ci().
9696
*/
97-
strcpy(fullname,pg_TZDIR());
97+
strlcpy(fullname,pg_TZDIR(),sizeof(fullname));
9898
orignamelen=fullnamelen=strlen(fullname);
9999
fname=name;
100100
for (;;)
@@ -428,7 +428,7 @@ identify_system_timezone(void)
428428
}
429429

430430
/* Search for the best-matching timezone file */
431-
strcpy(tmptzdir,pg_TZDIR());
431+
strlcpy(tmptzdir,pg_TZDIR(),sizeof(tmptzdir));
432432
bestscore=-1;
433433
resultbuf[0]='\0';
434434
scan_available_timezones(tmptzdir,tmptzdir+strlen(tmptzdir)+1,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp