Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit648e41a

Browse files
committed
Prevent a double free by not reentering be_tls_close().
Reentering this function with the right timing caused a double free,typically crashing the backend. By synchronizing a disconnection withthe authentication timeout, an unauthenticated attacker could achievethis somewhat consistently. Call be_tls_close() solely from withinproc_exit_prepare(). Back-patch to 9.0 (all supported versions).Benkocs Norbert AttilaSecurity:CVE-2015-3165
1 parent69cb7b9 commit648e41a

File tree

3 files changed

+28
-11
lines changed

3 files changed

+28
-11
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -906,7 +906,6 @@ open_server_SSL(Port *port)
906906
(errcode(ERRCODE_PROTOCOL_VIOLATION),
907907
errmsg("could not initialize SSL connection: %s",
908908
SSLerrmessage())));
909-
close_SSL(port);
910909
return-1;
911910
}
912911
if (!my_SSL_set_fd(port->ssl,port->sock))
@@ -915,7 +914,6 @@ open_server_SSL(Port *port)
915914
(errcode(ERRCODE_PROTOCOL_VIOLATION),
916915
errmsg("could not set SSL socket: %s",
917916
SSLerrmessage())));
918-
close_SSL(port);
919917
return-1;
920918
}
921919

@@ -963,7 +961,6 @@ open_server_SSL(Port *port)
963961
err)));
964962
break;
965963
}
966-
close_SSL(port);
967964
return-1;
968965
}
969966

@@ -992,7 +989,6 @@ open_server_SSL(Port *port)
992989
{
993990
/* shouldn't happen */
994991
pfree(peer_cn);
995-
close_SSL(port);
996992
return-1;
997993
}
998994

@@ -1006,7 +1002,6 @@ open_server_SSL(Port *port)
10061002
(errcode(ERRCODE_PROTOCOL_VIOLATION),
10071003
errmsg("SSL certificate's common name contains embedded null")));
10081004
pfree(peer_cn);
1009-
close_SSL(port);
10101005
return-1;
10111006
}
10121007

‎src/backend/libpq/pqcomm.c

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -170,32 +170,45 @@ pq_comm_reset(void)
170170
/* --------------------------------
171171
*pq_close - shutdown libpq at backend exit
172172
*
173-
* Note: in a standalone backend MyProcPort will be null,
174-
* don't crash during exit...
173+
* This is the one pg_on_exit_callback in place during BackendInitialize().
174+
* That function's unusual signal handling constrains that this callback be
175+
* safe to run at any instant.
175176
* --------------------------------
176177
*/
177178
staticvoid
178179
pq_close(intcode,Datumarg)
179180
{
181+
/* Nothing to do in a standalone backend, where MyProcPort is NULL. */
180182
if (MyProcPort!=NULL)
181183
{
182184
#if defined(ENABLE_GSS)|| defined(ENABLE_SSPI)
183185
#ifdefENABLE_GSS
184186
OM_uint32min_s;
185187

186-
/* Shutdown GSSAPI layer */
188+
/*
189+
* Shutdown GSSAPI layer. This section does nothing when interrupting
190+
* BackendInitialize(), because pg_GSS_recvauth() makes first use of
191+
* "ctx" and "cred".
192+
*/
187193
if (MyProcPort->gss->ctx!=GSS_C_NO_CONTEXT)
188194
gss_delete_sec_context(&min_s,&MyProcPort->gss->ctx,NULL);
189195

190196
if (MyProcPort->gss->cred!=GSS_C_NO_CREDENTIAL)
191197
gss_release_cred(&min_s,&MyProcPort->gss->cred);
192198
#endif/* ENABLE_GSS */
193-
/* GSS and SSPI share the port->gss struct */
194199

200+
/*
201+
* GSS and SSPI share the port->gss struct. Since nowhere else does a
202+
* postmaster child free this, doing so is safe when interrupting
203+
* BackendInitialize().
204+
*/
195205
free(MyProcPort->gss);
196206
#endif/* ENABLE_GSS || ENABLE_SSPI */
197207

198-
/* Cleanly shut down SSL layer */
208+
/*
209+
* Cleanly shut down SSL layer. Nowhere else does a postmaster child
210+
* call this, so this is safe when interrupting BackendInitialize().
211+
*/
199212
secure_close(MyProcPort);
200213

201214
/*

‎src/backend/postmaster/postmaster.c

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3417,7 +3417,16 @@ BackendInitialize(Port *port)
34173417
* We arrange for a simple exit(1) if we receive SIGTERM or SIGQUIT or
34183418
* timeout while trying to collect the startup packet. Otherwise the
34193419
* postmaster cannot shutdown the database FAST or IMMED cleanly if a
3420-
* buggy client fails to send the packet promptly.
3420+
* buggy client fails to send the packet promptly. XXX it follows that
3421+
* the remainder of this function must tolerate losing control at any
3422+
* instant. Likewise, any pg_on_exit_callback registered before or during
3423+
* this function must be prepared to execute at any instant between here
3424+
* and the end of this function. Furthermore, affected callbacks execute
3425+
* partially or not at all when a second exit-inducing signal arrives
3426+
* after proc_exit_prepare() decrements on_proc_exit_index. (Thanks to
3427+
* that mechanic, callbacks need not anticipate more than one call.) This
3428+
* is fragile; it ought to instead follow the norm of handling interrupts
3429+
* at selected, safe opportunities.
34213430
*/
34223431
pqsignal(SIGTERM,startup_die);
34233432
pqsignal(SIGQUIT,startup_die);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp