Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd3de70f

Browse files
committed
Compute aggregate argument types correctly in transformAggregateCall().
transformAggregateCall() captures the datatypes of the aggregate'sarguments immediately to construct the Aggref.aggargtypes list.This seems reasonable because the arguments have already beentransformed --- but there is an edge case where they haven't been.Specifically, if we have an unknown-type literal in an ANY argumentposition, nothing will have been done with it earlier. But if wealso have DISTINCT, then addTargetToGroupList() converts the literalto "text" type, resulting in the aggargtypes list not matching theactual runtime type of the argument. The end result is that theaggregate tries to interpret a "text" value as being of type"unknown", that is a zero-terminated C string. If the text valuecontains no zero bytes, this could result in disclosure of servermemory following the text literal value.To fix, move the collection of the aggargtypes list to the endof transformAggregateCall(), after DISTINCT has been handled.This requires slightly more code, but not a great deal.Our thanks to Jingzhou Fu for reporting this problem.Security:CVE-2023-5868
1 parent2c7a2a0 commitd3de70f

File tree

3 files changed

+33
-12
lines changed

3 files changed

+33
-12
lines changed

‎src/backend/parser/parse_agg.c

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -110,18 +110,6 @@ transformAggregateCall(ParseState *pstate, Aggref *agg,
110110
intsave_next_resno;
111111
ListCell*lc;
112112

113-
/*
114-
* Before separating the args into direct and aggregated args, make a list
115-
* of their data type OIDs for use later.
116-
*/
117-
foreach(lc,args)
118-
{
119-
Expr*arg= (Expr*)lfirst(lc);
120-
121-
argtypes=lappend_oid(argtypes,exprType((Node*)arg));
122-
}
123-
agg->aggargtypes=argtypes;
124-
125113
if (AGGKIND_IS_ORDERED_SET(agg->aggkind))
126114
{
127115
/*
@@ -233,6 +221,29 @@ transformAggregateCall(ParseState *pstate, Aggref *agg,
233221
agg->aggorder=torder;
234222
agg->aggdistinct=tdistinct;
235223

224+
/*
225+
* Now build the aggargtypes list with the type OIDs of the direct and
226+
* aggregated args, ignoring any resjunk entries that might have been
227+
* added by ORDER BY/DISTINCT processing. We can't do this earlier
228+
* because said processing can modify some args' data types, in particular
229+
* by resolving previously-unresolved "unknown" literals.
230+
*/
231+
foreach(lc,agg->aggdirectargs)
232+
{
233+
Expr*arg= (Expr*)lfirst(lc);
234+
235+
argtypes=lappend_oid(argtypes,exprType((Node*)arg));
236+
}
237+
foreach(lc,tlist)
238+
{
239+
TargetEntry*tle= (TargetEntry*)lfirst(lc);
240+
241+
if (tle->resjunk)
242+
continue;/* ignore junk */
243+
argtypes=lappend_oid(argtypes,exprType((Node*)tle->expr));
244+
}
245+
agg->aggargtypes=argtypes;
246+
236247
check_agglevels_and_constraints(pstate, (Node*)agg);
237248
}
238249

‎src/test/regress/expected/jsonb.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,6 +1527,13 @@ SELECT jsonb_object_agg(name, type) FROM foo;
15271527
INSERT INTO foo VALUES (999999, NULL, 'bar');
15281528
SELECT jsonb_object_agg(name, type) FROM foo;
15291529
ERROR: field name must not be null
1530+
-- edge case for parser
1531+
SELECT jsonb_object_agg(DISTINCT 'a', 'abc');
1532+
jsonb_object_agg
1533+
------------------
1534+
{"a": "abc"}
1535+
(1 row)
1536+
15301537
-- jsonb_object
15311538
-- empty object, one dimension
15321539
SELECT jsonb_object('{}');

‎src/test/regress/sql/jsonb.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,9 @@ SELECT jsonb_object_agg(name, type) FROM foo;
380380
INSERT INTO fooVALUES (999999,NULL,'bar');
381381
SELECT jsonb_object_agg(name, type)FROM foo;
382382

383+
-- edge case for parser
384+
SELECT jsonb_object_agg(DISTINCT'a','abc');
385+
383386
-- jsonb_object
384387

385388
-- empty object, one dimension

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp