mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-13 23:19:35 +02:00
0c071936e9
This reverts commit16304a0134, except for its changes in src/port/snprintf.c; as well as commitcac18a76bbwhich is no longer needed. Fujii Masao reported that the previous commit caused failures in psql on OS X, since if one exits the pager program early while viewing a query result, psql sees an EPIPE error from fprintf --- and the wrapper function thought that was reason to panic. (It's a bit surprising that the same does not happen on Linux.) Further discussion among the security list concluded that the risk of other such failures was far too great, and that the one-size-fits-all approach to error handling embodied in the previous patch is unlikely to be workable. This leaves us again exposed to the possibility of the type of failure envisioned in CVE-2015-3166. However, that failure mode is strictly hypothetical at this point: there is no concrete reason to believe that an attacker could trigger information disclosure through the supposed mechanism. In the first place, the attack surface is fairly limited, since so much of what the backend does with format strings goes through stringinfo.c or psprintf(), and those already had adequate defenses. In the second place, even granting that an unprivileged attacker could control the occurrence of ENOMEM with some precision, it's a stretch to believe that he could induce it just where the target buffer contains some valuable information. So we concluded that the risk of non-hypothetical problems induced by the patch greatly outweighs the security risks. We will therefore revert, and instead undertake closer analysis to identify specific calls that may need hardening, rather than attempt a universal solution. We have kept the portion of the previous patch that improved snprintf.c's handling of errors when it calls the platform's sprintf(). That seems to be an unalloyed improvement. Security: CVE-2015-3166
151 lines
4.1 KiB
C
151 lines
4.1 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* plpython.h - Python as a procedural language for PostgreSQL
|
|
*
|
|
* Portions Copyright (c) 1996-2015, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* src/pl/plpython/plpython.h
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
#ifndef PLPYTHON_H
|
|
#define PLPYTHON_H
|
|
|
|
/*
|
|
* Include order should be: postgres.h, other postgres headers, plpython.h,
|
|
* other plpython headers
|
|
*/
|
|
#ifndef POSTGRES_H
|
|
#error postgres.h must be included before plpython.h
|
|
#endif
|
|
|
|
/*
|
|
* Undefine some things that get (re)defined in the Python headers. They aren't
|
|
* used by the PL/Python code, and all PostgreSQL headers should be included
|
|
* earlier, so this should be pretty safe.
|
|
*/
|
|
#undef _POSIX_C_SOURCE
|
|
#undef _XOPEN_SOURCE
|
|
#undef HAVE_STRERROR
|
|
#undef HAVE_TZNAME
|
|
|
|
/*
|
|
* Sometimes python carefully scribbles on our *printf macros.
|
|
* So we undefine them here and redefine them after it's done its dirty deed.
|
|
*/
|
|
|
|
#ifdef USE_REPL_SNPRINTF
|
|
#undef snprintf
|
|
#undef vsnprintf
|
|
#endif
|
|
|
|
#if defined(_MSC_VER) && defined(_DEBUG)
|
|
/* Python uses #pragma to bring in a non-default libpython on VC++ if
|
|
* _DEBUG is defined */
|
|
#undef _DEBUG
|
|
/* Also hide away errcode, since we load Python.h before postgres.h */
|
|
#define errcode __msvc_errcode
|
|
#include <Python.h>
|
|
#undef errcode
|
|
#define _DEBUG
|
|
#elif defined (_MSC_VER)
|
|
#define errcode __msvc_errcode
|
|
#include <Python.h>
|
|
#undef errcode
|
|
#else
|
|
#include <Python.h>
|
|
#endif
|
|
|
|
/*
|
|
* Py_ssize_t compat for Python <= 2.4
|
|
*/
|
|
#if PY_VERSION_HEX < 0x02050000 && !defined(PY_SSIZE_T_MIN)
|
|
typedef int Py_ssize_t;
|
|
|
|
#define PY_SSIZE_T_MAX INT_MAX
|
|
#define PY_SSIZE_T_MIN INT_MIN
|
|
#endif
|
|
|
|
/*
|
|
* Python 2/3 strings/unicode/bytes handling. Python 2 has strings
|
|
* and unicode, Python 3 has strings, which are unicode on the C
|
|
* level, and bytes. The porting convention, which is similarly used
|
|
* in Python 2.6, is that "Unicode" is always unicode, and "Bytes" are
|
|
* bytes in Python 3 and strings in Python 2. Since we keep
|
|
* supporting Python 2 and its usual strings, we provide a
|
|
* compatibility layer for Python 3 that when asked to convert a C
|
|
* string to a Python string it converts the C string from the
|
|
* PostgreSQL server encoding to a Python Unicode object.
|
|
*/
|
|
|
|
#if PY_VERSION_HEX < 0x02060000
|
|
/* This is exactly the compatibility layer that Python 2.6 uses. */
|
|
#define PyBytes_AsString PyString_AsString
|
|
#define PyBytes_FromStringAndSize PyString_FromStringAndSize
|
|
#define PyBytes_Size PyString_Size
|
|
#define PyObject_Bytes PyObject_Str
|
|
#endif
|
|
|
|
#if PY_MAJOR_VERSION >= 3
|
|
#define PyString_Check(x) 0
|
|
#define PyString_AsString(x) PLyUnicode_AsString(x)
|
|
#define PyString_FromString(x) PLyUnicode_FromString(x)
|
|
#define PyString_FromStringAndSize(x, size) PLyUnicode_FromStringAndSize(x, size)
|
|
#endif
|
|
|
|
/*
|
|
* Python 3 only has long.
|
|
*/
|
|
#if PY_MAJOR_VERSION >= 3
|
|
#define PyInt_FromLong(x) PyLong_FromLong(x)
|
|
#define PyInt_AsLong(x) PyLong_AsLong(x)
|
|
#endif
|
|
|
|
/*
|
|
* PyVarObject_HEAD_INIT was added in Python 2.6. Its use is
|
|
* necessary to handle both Python 2 and 3. This replacement
|
|
* definition is for Python <=2.5
|
|
*/
|
|
#ifndef PyVarObject_HEAD_INIT
|
|
#define PyVarObject_HEAD_INIT(type, size) \
|
|
PyObject_HEAD_INIT(type) size,
|
|
#endif
|
|
|
|
/* Python 3 removed the Py_TPFLAGS_HAVE_ITER flag */
|
|
#if PY_MAJOR_VERSION >= 3
|
|
#define Py_TPFLAGS_HAVE_ITER 0
|
|
#endif
|
|
|
|
/* define our text domain for translations */
|
|
#undef TEXTDOMAIN
|
|
#define TEXTDOMAIN PG_TEXTDOMAIN("plpython")
|
|
|
|
#include <compile.h>
|
|
#include <eval.h>
|
|
|
|
/* put back our snprintf and vsnprintf */
|
|
#ifdef USE_REPL_SNPRINTF
|
|
#ifdef snprintf
|
|
#undef snprintf
|
|
#endif
|
|
#ifdef vsnprintf
|
|
#undef vsnprintf
|
|
#endif
|
|
#ifdef __GNUC__
|
|
#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__)
|
|
#define snprintf(...) pg_snprintf(__VA_ARGS__)
|
|
#else
|
|
#define vsnprintf pg_vsnprintf
|
|
#define snprintf pg_snprintf
|
|
#endif /* __GNUC__ */
|
|
#endif /* USE_REPL_SNPRINTF */
|
|
|
|
/*
|
|
* Used throughout, and also by the Python 2/3 porting layer, so it's easier to
|
|
* just include it everywhere.
|
|
*/
|
|
#include "plpy_util.h"
|
|
|
|
#endif /* PLPYTHON_H */
|