mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-04 13:47:20 +02:00
Fix sscanf limits in pg_basebackup and pg_dump
Make sure that the string parsing is limited by the size of the destination buffer. In pg_basebackup the available values sent from the server is limited to two characters so there was no risk of overflow. In pg_dump the buffer is bounded by MAXPGPATH, and thus the limit must be inserted via preprocessor expansion and the buffer increased by one to account for the terminator. There is no risk of overflow here, since in this case, the buffer scanned is smaller than the destination buffer. Backpatch the pg_basebackup fix to 11 where it was introduced, and the pg_dump fix all the way down to 9.6. Reviewed-by: Tom Lane Discussion: https://postgr.es/m/B14D3D7B-F98C-4E20-9459-C122C67647FB@yesql.se Backpatch-through: 11 and 9.6
This commit is contained in:
parent
8b26be8a32
commit
57bf8f7b75
@ -311,7 +311,7 @@ RetrieveWalSegSize(PGconn *conn)
|
|||||||
}
|
}
|
||||||
|
|
||||||
/* fetch xlog value and unit from the result */
|
/* fetch xlog value and unit from the result */
|
||||||
if (sscanf(PQgetvalue(res, 0, 0), "%d%s", &xlog_val, xlog_unit) != 2)
|
if (sscanf(PQgetvalue(res, 0, 0), "%d%2s", &xlog_val, xlog_unit) != 2)
|
||||||
{
|
{
|
||||||
pg_log_error("WAL segment size could not be parsed");
|
pg_log_error("WAL segment size could not be parsed");
|
||||||
PQclear(res);
|
PQclear(res);
|
||||||
|
@ -451,11 +451,11 @@ _LoadBlobs(ArchiveHandle *AH)
|
|||||||
/* Read the blobs TOC file line-by-line, and process each blob */
|
/* Read the blobs TOC file line-by-line, and process each blob */
|
||||||
while ((cfgets(ctx->blobsTocFH, line, MAXPGPATH)) != NULL)
|
while ((cfgets(ctx->blobsTocFH, line, MAXPGPATH)) != NULL)
|
||||||
{
|
{
|
||||||
char fname[MAXPGPATH];
|
char fname[MAXPGPATH + 1];
|
||||||
char path[MAXPGPATH];
|
char path[MAXPGPATH];
|
||||||
|
|
||||||
/* Can't overflow because line and fname are the same length. */
|
/* Can't overflow because line and fname are the same length. */
|
||||||
if (sscanf(line, "%u %s\n", &oid, fname) != 2)
|
if (sscanf(line, "%u %" CppAsString2(MAXPGPATH) "s\n", &oid, fname) != 2)
|
||||||
fatal("invalid line in large object TOC file \"%s\": \"%s\"",
|
fatal("invalid line in large object TOC file \"%s\": \"%s\"",
|
||||||
fname, line);
|
fname, line);
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user