Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite75b5c8

Browse files
committed
Reject CancelRequestPacket having unexpected length.
When the length was too short, the server read outside the allocation.That yielded the same log noise as sending the correct length with(backendPID,cancelAuthCode) matching nothing. Change to a message aboutthe unexpected length. Given the attacker's lack of control over thememory layout and the general lack of diversity in memory layouts at thecode in question, we doubt a would-be attacker could cause a segfault.Hence, while the report arrived via security@postgresql.org, this is nota vulnerability. Back-patch to v11 (all supported versions).Andrey Borodin, reviewed by Tom Lane. Reported by Andrey Borodin.
1 parent6d066d5 commite75b5c8

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

‎src/backend/postmaster/postmaster.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2000,6 +2000,13 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20002000

20012001
if (proto==CANCEL_REQUEST_CODE)
20022002
{
2003+
if (len!=sizeof(CancelRequestPacket))
2004+
{
2005+
ereport(COMMERROR,
2006+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2007+
errmsg("invalid length of startup packet")));
2008+
returnSTATUS_ERROR;
2009+
}
20032010
processCancelRequest(port,buf);
20042011
/* Not really an error, but we don't want to proceed further */
20052012
returnSTATUS_ERROR;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp