forked frompostgres/postgres
- Notifications
You must be signed in to change notification settings - Fork6
Commitde34381
committed
Fix buffer overrun in unicode string normalization with empty input
PostgreSQL 13 and newer versions are directly impacted by that throughthe SQL function normalize(), which would cause a call of this functionto write one byte past its allocation if using in input an emptystring after recomposing the string with NFC and NFKC. Older versions(v10~v12) are not directly affected by this problem as the only codepath using normalization is SASLprep in SCRAM authentication thatforbids the case of an empty string, but let's make the code more robustanyway there so as any out-of-core callers of this function are covered.The solution chosen to fix this issue is simple, with the addition of afast-exit path if the decomposed string is found as empty. This wouldonly happen for an empty string as at its lowest level a codepoint wouldbe decomposed as itself if it has no entry in the decomposition table orif it has a decomposition size of 0.Some tests are added to cover this issue in v13~. Note that an emptystring has always been considered as normalized (grammar "IS NF[K]{C,D}NORMALIZED", through the SQL function is_normalized()) for all theoperations allowed (NFC, NFD, NFKC and NFKD) since this feature has beenintroduced as of2991ac5. This behavior is unchanged but some tests areadded in v13~ to check after that.I have also checked "make normalization-check" in src/common/unicode/,while on it (works in 13~, and breaks in older stable branchesindependently of this commit).The release notes should just mention this commit for v13~.Reported-by: Matthijs van der VleutenDiscussion:https://postgr.es/m/17277-0c527a373794e802@postgresql.orgBackpatch-through: 101 parent109279e commitde34381
1 file changed
+4
-0
lines changedLines changed: 4 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
342 | 342 | | |
343 | 343 | | |
344 | 344 | | |
| 345 | + | |
| 346 | + | |
| 347 | + | |
| 348 | + | |
345 | 349 | | |
346 | 350 | | |
347 | 351 | | |
| |||
0 commit comments
Comments
(0)