Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9146d0d

Browse files
committed
Compute aggregate argument types correctly in transformAggregateCall().
transformAggregateCall() captures the datatypes of the aggregate'sarguments immediately to construct the Aggref.aggargtypes list.This seems reasonable because the arguments have already beentransformed --- but there is an edge case where they haven't been.Specifically, if we have an unknown-type literal in an ANY argumentposition, nothing will have been done with it earlier. But if wealso have DISTINCT, then addTargetToGroupList() converts the literalto "text" type, resulting in the aggargtypes list not matching theactual runtime type of the argument. The end result is that theaggregate tries to interpret a "text" value as being of type"unknown", that is a zero-terminated C string. If the text valuecontains no zero bytes, this could result in disclosure of servermemory following the text literal value.To fix, move the collection of the aggargtypes list to the endof transformAggregateCall(), after DISTINCT has been handled.This requires slightly more code, but not a great deal.Our thanks to Jingzhou Fu for reporting this problem.Security:CVE-2023-5868
1 parentecd5d24 commit9146d0d

File tree

3 files changed

+33
-12
lines changed

3 files changed

+33
-12
lines changed

‎src/backend/parser/parse_agg.c

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -110,18 +110,6 @@ transformAggregateCall(ParseState *pstate, Aggref *agg,
110110
intsave_next_resno;
111111
ListCell*lc;
112112

113-
/*
114-
* Before separating the args into direct and aggregated args, make a list
115-
* of their data type OIDs for use later.
116-
*/
117-
foreach(lc,args)
118-
{
119-
Expr*arg= (Expr*)lfirst(lc);
120-
121-
argtypes=lappend_oid(argtypes,exprType((Node*)arg));
122-
}
123-
agg->aggargtypes=argtypes;
124-
125113
if (AGGKIND_IS_ORDERED_SET(agg->aggkind))
126114
{
127115
/*
@@ -233,6 +221,29 @@ transformAggregateCall(ParseState *pstate, Aggref *agg,
233221
agg->aggorder=torder;
234222
agg->aggdistinct=tdistinct;
235223

224+
/*
225+
* Now build the aggargtypes list with the type OIDs of the direct and
226+
* aggregated args, ignoring any resjunk entries that might have been
227+
* added by ORDER BY/DISTINCT processing. We can't do this earlier
228+
* because said processing can modify some args' data types, in particular
229+
* by resolving previously-unresolved "unknown" literals.
230+
*/
231+
foreach(lc,agg->aggdirectargs)
232+
{
233+
Expr*arg= (Expr*)lfirst(lc);
234+
235+
argtypes=lappend_oid(argtypes,exprType((Node*)arg));
236+
}
237+
foreach(lc,tlist)
238+
{
239+
TargetEntry*tle= (TargetEntry*)lfirst(lc);
240+
241+
if (tle->resjunk)
242+
continue;/* ignore junk */
243+
argtypes=lappend_oid(argtypes,exprType((Node*)tle->expr));
244+
}
245+
agg->aggargtypes=argtypes;
246+
236247
check_agglevels_and_constraints(pstate, (Node*)agg);
237248
}
238249

‎src/test/regress/expected/jsonb.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1558,6 +1558,13 @@ SELECT jsonb_object_agg(name, type) FROM foo;
15581558
INSERT INTO foo VALUES (999999, NULL, 'bar');
15591559
SELECT jsonb_object_agg(name, type) FROM foo;
15601560
ERROR: field name must not be null
1561+
-- edge case for parser
1562+
SELECT jsonb_object_agg(DISTINCT 'a', 'abc');
1563+
jsonb_object_agg
1564+
------------------
1565+
{"a": "abc"}
1566+
(1 row)
1567+
15611568
-- jsonb_object
15621569
-- empty object, one dimension
15631570
SELECT jsonb_object('{}');

‎src/test/regress/sql/jsonb.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,9 @@ SELECT jsonb_object_agg(name, type) FROM foo;
397397
INSERT INTO fooVALUES (999999,NULL,'bar');
398398
SELECT jsonb_object_agg(name, type)FROM foo;
399399

400+
-- edge case for parser
401+
SELECT jsonb_object_agg(DISTINCT'a','abc');
402+
400403
-- jsonb_object
401404

402405
-- empty object, one dimension

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp