Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite52daaa

Browse files
committed
Reject CancelRequestPacket having unexpected length.
When the length was too short, the server read outside the allocation.That yielded the same log noise as sending the correct length with(backendPID,cancelAuthCode) matching nothing. Change to a message aboutthe unexpected length. Given the attacker's lack of control over thememory layout and the general lack of diversity in memory layouts at thecode in question, we doubt a would-be attacker could cause a segfault.Hence, while the report arrived via security@postgresql.org, this is nota vulnerability. Back-patch to v11 (all supported versions).Andrey Borodin, reviewed by Tom Lane. Reported by Andrey Borodin.
1 parent03023a2 commite52daaa

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

‎src/backend/postmaster/postmaster.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2016,6 +2016,13 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20162016

20172017
if (proto==CANCEL_REQUEST_CODE)
20182018
{
2019+
if (len!=sizeof(CancelRequestPacket))
2020+
{
2021+
ereport(COMMERROR,
2022+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2023+
errmsg("invalid length of startup packet")));
2024+
returnSTATUS_ERROR;
2025+
}
20192026
processCancelRequest(port,buf);
20202027
/* Not really an error, but we don't want to proceed further */
20212028
returnSTATUS_ERROR;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp