Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit57bf8f7

Browse files
Fix sscanf limits in pg_basebackup and pg_dump
Make sure that the string parsing is limited by the size of thedestination buffer.In pg_basebackup the available values sent from the serveris limited to two characters so there was no risk of overflow.In pg_dump the buffer is bounded by MAXPGPATH, and thus the limitmust be inserted via preprocessor expansion and the buffer increasedby one to account for the terminator. There is no risk of overflowhere, since in this case, the buffer scanned is smaller than thedestination buffer.Backpatch the pg_basebackup fix to 11 where it was introduced, andthe pg_dump fix all the way down to 9.6.Reviewed-by: Tom LaneDiscussion:https://postgr.es/m/B14D3D7B-F98C-4E20-9459-C122C67647FB@yesql.seBackpatch-through: 11 and 9.6
1 parent8b26be8 commit57bf8f7

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

‎src/bin/pg_basebackup/streamutil.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ RetrieveWalSegSize(PGconn *conn)
311311
}
312312

313313
/* fetch xlog value and unit from the result */
314-
if (sscanf(PQgetvalue(res,0,0),"%d%s",&xlog_val,xlog_unit)!=2)
314+
if (sscanf(PQgetvalue(res,0,0),"%d%2s",&xlog_val,xlog_unit)!=2)
315315
{
316316
pg_log_error("WAL segment size could not be parsed");
317317
PQclear(res);

‎src/bin/pg_dump/pg_backup_directory.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -451,11 +451,11 @@ _LoadBlobs(ArchiveHandle *AH)
451451
/* Read the blobs TOC file line-by-line, and process each blob */
452452
while ((cfgets(ctx->blobsTocFH,line,MAXPGPATH))!=NULL)
453453
{
454-
charfname[MAXPGPATH];
454+
charfname[MAXPGPATH+1];
455455
charpath[MAXPGPATH];
456456

457457
/* Can't overflow because line and fname are the same length. */
458-
if (sscanf(line,"%u %s\n",&oid,fname)!=2)
458+
if (sscanf(line,"%u %"CppAsString2(MAXPGPATH)"s\n",&oid,fname)!=2)
459459
fatal("invalid line in large object TOC file \"%s\": \"%s\"",
460460
fname,line);
461461

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp