Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8d98819

Browse files
committed
Require update permission for the large object written by lo_put().
lo_put() surely should require UPDATE permission, the same as lowrite(),but it failed to check for that, as reported by Chapman Flack. Oversightin commitc50b7c0; backpatch to 9.4 where that was introduced.Tom Lane and Michael PaquierSecurity:CVE-2017-7548
1 parente568e1e commit8d98819

File tree

3 files changed

+26
-0
lines changed

3 files changed

+26
-0
lines changed

‎src/backend/libpq/be-fsstubs.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -896,6 +896,18 @@ be_lo_put(PG_FUNCTION_ARGS)
896896
CreateFSContext();
897897

898898
loDesc=inv_open(loOid,INV_WRITE,fscxt);
899+
900+
/* Permission check */
901+
if (!lo_compat_privileges&&
902+
pg_largeobject_aclcheck_snapshot(loDesc->id,
903+
GetUserId(),
904+
ACL_UPDATE,
905+
loDesc->snapshot)!=ACLCHECK_OK)
906+
ereport(ERROR,
907+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
908+
errmsg("permission denied for large object %u",
909+
loDesc->id)));
910+
899911
inv_seek(loDesc,offset,SEEK_SET);
900912
written=inv_write(loDesc,VARDATA_ANY(str),VARSIZE_ANY_EXHDR(str));
901913
Assert(written==VARSIZE_ANY_EXHDR(str));

‎src/test/regress/expected/privileges.out

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1238,6 +1238,14 @@ SELECT lo_create(2002);
12381238
2002
12391239
(1 row)
12401240

1241+
SELECT loread(lo_open(1001, x'20000'::int), 32);-- allowed, for now
1242+
loread
1243+
--------
1244+
\x
1245+
(1 row)
1246+
1247+
SELECT lowrite(lo_open(1001, x'40000'::int), 'abcd');-- fail, wrong mode
1248+
ERROR: large object descriptor 0 was not opened for writing
12411249
SELECT loread(lo_open(1001, x'40000'::int), 32);
12421250
loread
12431251
--------
@@ -1333,6 +1341,8 @@ SELECT lowrite(lo_open(1002, x'20000'::int), 'abcd');-- to be denied
13331341
ERROR: permission denied for large object 1002
13341342
SELECT lo_truncate(lo_open(1002, x'20000'::int), 10);-- to be denied
13351343
ERROR: permission denied for large object 1002
1344+
SELECT lo_put(1002, 1, 'abcd');-- to be denied
1345+
ERROR: permission denied for large object 1002
13361346
SELECT lo_unlink(1002);-- to be denied
13371347
ERROR: must be owner of large object 1002
13381348
SELECT lo_export(1001, '/dev/null');-- to be denied

‎src/test/regress/sql/privileges.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -779,6 +779,9 @@ SET SESSION AUTHORIZATION regress_user2;
779779
SELECT lo_create(2001);
780780
SELECT lo_create(2002);
781781

782+
SELECT loread(lo_open(1001, x'20000'::int),32);-- allowed, for now
783+
SELECT lowrite(lo_open(1001, x'40000'::int),'abcd');-- fail, wrong mode
784+
782785
SELECT loread(lo_open(1001, x'40000'::int),32);
783786
SELECT loread(lo_open(1002, x'40000'::int),32);-- to be denied
784787
SELECT loread(lo_open(1003, x'40000'::int),32);
@@ -818,6 +821,7 @@ SET SESSION AUTHORIZATION regress_user4;
818821
SELECT loread(lo_open(1002, x'40000'::int),32);-- to be denied
819822
SELECT lowrite(lo_open(1002, x'20000'::int),'abcd');-- to be denied
820823
SELECT lo_truncate(lo_open(1002, x'20000'::int),10);-- to be denied
824+
SELECT lo_put(1002,1,'abcd');-- to be denied
821825
SELECT lo_unlink(1002);-- to be denied
822826
SELECT lo_export(1001,'/dev/null');-- to be denied
823827

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp