Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite7a2217

Browse files
committed
Parse more strictly integer parameters from connection strings in libpq
The following parameters have been parsed in lossy ways when specifiedin a connection string processed by libpq:- connect_timeout- keepalives- keepalives_count- keepalives_idle- keepalives_interval- portOverflowing values or the presence of incorrect characters were notproperly checked, leading to libpq trying to use such values and failwith unhelpful error messages. This commit hardens the parsing of thoseparameters so as it is possible to find easily incorrect values.Author: Fabien CoelhoReviewed-by: Peter Eisentraut, Michael PaquierDiscussion:https://postgr.es/m/alpine.DEB.2.21.1808171206180.20841@lancre
1 parent0d45cd9 commite7a2217

File tree

1 file changed

+54
-9
lines changed

1 file changed

+54
-9
lines changed

‎src/interfaces/libpq/fe-connect.c

Lines changed: 54 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1587,6 +1587,34 @@ useKeepalives(PGconn *conn)
15871587
returnval!=0 ?1 :0;
15881588
}
15891589

1590+
/*
1591+
* Parse and try to interpret "value" as an integer value, and if successful,
1592+
* store it in *result, complaining if there is any trailing garbage or an
1593+
* overflow.
1594+
*/
1595+
staticbool
1596+
parse_int_param(constchar*value,int*result,PGconn*conn,
1597+
constchar*context)
1598+
{
1599+
char*end;
1600+
longnumval;
1601+
1602+
*result=0;
1603+
1604+
errno=0;
1605+
numval=strtol(value,&end,10);
1606+
if (errno==0&&*end=='\0'&&numval== (int)numval)
1607+
{
1608+
*result=numval;
1609+
return true;
1610+
}
1611+
1612+
appendPQExpBuffer(&conn->errorMessage,
1613+
libpq_gettext("invalid integer value \"%s\" for keyword \"%s\"\n"),
1614+
value,context);
1615+
return false;
1616+
}
1617+
15901618
#ifndefWIN32
15911619
/*
15921620
* Set the keepalive idle timer.
@@ -1599,7 +1627,9 @@ setKeepalivesIdle(PGconn *conn)
15991627
if (conn->keepalives_idle==NULL)
16001628
return1;
16011629

1602-
idle=atoi(conn->keepalives_idle);
1630+
if (!parse_int_param(conn->keepalives_idle,&idle,conn,
1631+
"keepalives_idle"))
1632+
return0;
16031633
if (idle<0)
16041634
idle=0;
16051635

@@ -1631,7 +1661,9 @@ setKeepalivesInterval(PGconn *conn)
16311661
if (conn->keepalives_interval==NULL)
16321662
return1;
16331663

1634-
interval=atoi(conn->keepalives_interval);
1664+
if (!parse_int_param(conn->keepalives_interval,&interval,conn,
1665+
"keepalives_interval"))
1666+
return0;
16351667
if (interval<0)
16361668
interval=0;
16371669

@@ -1664,7 +1696,9 @@ setKeepalivesCount(PGconn *conn)
16641696
if (conn->keepalives_count==NULL)
16651697
return1;
16661698

1667-
count=atoi(conn->keepalives_count);
1699+
if (!parse_int_param(conn->keepalives_count,&count,conn,
1700+
"keepalives_count"))
1701+
return0;
16681702
if (count<0)
16691703
count=0;
16701704

@@ -1698,13 +1732,17 @@ setKeepalivesWin32(PGconn *conn)
16981732
intidle=0;
16991733
intinterval=0;
17001734

1701-
if (conn->keepalives_idle)
1702-
idle=atoi(conn->keepalives_idle);
1735+
if (conn->keepalives_idle&&
1736+
!parse_int_param(conn->keepalives_idle,&idle,conn,
1737+
"keepalives_idle"))
1738+
return0;
17031739
if (idle <=0)
17041740
idle=2*60*60;/* 2 hours = default */
17051741

1706-
if (conn->keepalives_interval)
1707-
interval=atoi(conn->keepalives_interval);
1742+
if (conn->keepalives_interval&&
1743+
!parse_int_param(conn->keepalives_interval,&interval,conn,
1744+
"keepalives_interval"))
1745+
return0;
17081746
if (interval <=0)
17091747
interval=1;/* 1 second = default */
17101748

@@ -1831,7 +1869,10 @@ connectDBComplete(PGconn *conn)
18311869
*/
18321870
if (conn->connect_timeout!=NULL)
18331871
{
1834-
timeout=atoi(conn->connect_timeout);
1872+
if (!parse_int_param(conn->connect_timeout,&timeout,conn,
1873+
"connect_timeout"))
1874+
return0;
1875+
18351876
if (timeout>0)
18361877
{
18371878
/*
@@ -1842,6 +1883,8 @@ connectDBComplete(PGconn *conn)
18421883
if (timeout<2)
18431884
timeout=2;
18441885
}
1886+
else/* negative means 0 */
1887+
timeout=0;
18451888
}
18461889

18471890
for (;;)
@@ -2108,7 +2151,9 @@ PQconnectPoll(PGconn *conn)
21082151
thisport=DEF_PGPORT;
21092152
else
21102153
{
2111-
thisport=atoi(ch->port);
2154+
if (!parse_int_param(ch->port,&thisport,conn,"port"))
2155+
gotoerror_return;
2156+
21122157
if (thisport<1||thisport>65535)
21132158
{
21142159
appendPQExpBuffer(&conn->errorMessage,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp