rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
postgresql/src/backend/utils/adt
History
Tom Lane edc0a8d82a Detect integer overflow while computing new array dimensions. 
array_set_element() and related functions allow an array to be
enlarged by assigning to subscripts outside the current array bounds.
While these places were careful to check that the new bounds are
allowable, they neglected to consider the risk of integer overflow
in computing the new bounds.  In edge cases, we could compute new
bounds that are invalid but get past the subsequent checks,
allowing bad things to happen.  Memory stomps that are potentially
exploitable for arbitrary code execution are possible, and so is
disclosure of server memory.

To fix, perform the hazardous computations using overflow-detecting
arithmetic routines, which fortunately exist in all still-supported
branches.

The test cases added for this generate (after patching) errors that
mention the value of MaxArraySize, which is platform-dependent.
Rather than introduce multiple expected-files, use psql's VERBOSITY
parameter to suppress the printing of the message text.  v11 psql
lacks that parameter, so omit the tests in that branch.

Our thanks to Pedro Gallegos for reporting this problem.

Security: CVE-2023-5869
 		2023-11-06 10:56:43 -05:00
..
.gitignore Revert "Add gitignore entries for jsonpath_gram.h" 2019-03-23 00:19:34 +01:00
Makefile Use "-I." in directories holding Bison parsers, for Oracle compilers. 2021-04-12 19:24:41 -07:00
acl.c Change some errdetail() to errdetail_internal() 2022-09-28 17:14:53 +02:00
amutils.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
array_expanded.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
array_selfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
array_typanalyze.c Suppress variable-set-but-not-used warnings from clang 15. 2022-09-20 12:04:37 -04:00
array_userfuncs.c In array_position()/array_positions(), beware of empty input array. 2023-05-04 11:48:23 -04:00
arrayfuncs.c Detect integer overflow while computing new array dimensions. 2023-11-06 10:56:43 -05:00
arraysubs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
arrayutils.c Detect integer overflow while computing new array dimensions. 2023-11-06 10:56:43 -05:00
ascii.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
bool.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
cash.c Expose internal function for converting int64 to numeric 2020-09-09 20:16:28 +02:00
char.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
cryptohashfuncs.c Revert error handling improvements for cryptohashes 2022-01-14 11:25:39 +09:00
date.c Dodge a compiler bug affecting timetz_zone/timetz_izone. 2023-10-20 13:40:15 -04:00
datetime.c Revert use singular for -1 (commits 9ee7d533da and 5da9868ed9 2021-05-01 10:42:44 -04:00
datum.c Dissociate btequalimage() from interval_ops, ending its deduplication. 2023-10-14 16:33:54 -07:00
dbsize.c Fix incorrect return value in pg_size_pretty(bigint) 2021-07-09 14:04:40 +12:00
domains.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
encode.c Revert refactoring of hex code to src/common/ 2021-08-19 09:20:19 +09:00
enum.c Rename "enum blacklist" to "uncommitted enums". 2021-01-05 12:38:48 +13:00
expandeddatum.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
expandedrecord.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
float.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
format_type.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
formatting.c Fix corner case bug in numeric to_char() some more. 2023-03-14 19:17:31 -04:00
genfile.c Initial pgindent and pgperltidy run for v14. 2021-05-12 13:14:10 -04:00
geo_ops.c Fix NaN comparison in circle_same test 2022-09-12 12:59:06 +02:00
geo_selfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
geo_spgist.c Fix more confusion in SP-GiST. 2021-04-04 17:57:07 -04:00
inet_cidr_ntop.c Avoid conflicts with library versions of inet_net_ntop() and friends. 2019-08-18 19:27:23 -04:00
inet_net_pton.c Avoid conflicts with library versions of inet_net_ntop() and friends. 2019-08-18 19:27:23 -04:00
int.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
int8.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
json.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
jsonb.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
jsonb_gin.c Fix jsonb subscripting to cope with toasted subscript values. 2022-12-12 16:17:49 -05:00
jsonb_op.c Fix jsonb subscripting to cope with toasted subscript values. 2022-12-12 16:17:49 -05:00
jsonb_util.c Implementation of subscripting for jsonb 2021-01-31 23:50:40 +03:00
jsonbsubs.c Message style improvements 2021-09-16 15:36:58 +02:00
jsonfuncs.c Fix JSON error reporting for many cases of erroneous string values. 2023-03-13 15:19:00 -04:00
jsonpath.c Fix overly strict Assert in jsonpath code 2023-08-02 01:41:21 +12:00
jsonpath_exec.c Accept fractional seconds in jsonpath's datetime() method. 2023-06-12 10:54:28 -04:00
jsonpath_gram.y Suppress variable-set-but-not-used warnings from clang 15. 2022-09-20 12:04:37 -04:00
jsonpath_scan.l Update copyright for 2021 2021-01-02 13:06:25 -05:00
levenshtein.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
like.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
like_match.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
like_support.c Defend against stack overrun in a few more places. 2022-08-24 13:01:40 -04:00
lockfuncs.c Rename debug_invalidate_system_caches_always to debug_discard_caches. 2021-07-13 15:01:01 -04:00
mac.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
mac8.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
mcxtfuncs.c Reorder superuser check in pg_log_backend_memory_contexts() 2021-06-08 08:53:12 +09:00
misc.c Allow "in place" tablespaces. 2022-07-27 07:55:13 +02:00
multirangetypes.c Fix alignment in multirange_get_range() function 2021-12-13 17:20:07 +03:00
multirangetypes_selfuncs.c Remove duplicate lines of code 2023-04-24 11:16:17 +02:00
name.c Initial pgindent and pgperltidy run for v14. 2021-05-12 13:14:10 -04:00
network.c Work around spurious compiler warning in inet operators 2023-03-16 14:48:46 -07:00
network_gist.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
network_selfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
network_spgist.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
numeric.c Make int64_div_fast_to_numeric() more robust. 2023-02-03 11:09:15 +00:00
numutils.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
oid.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
oracle_compat.c Avoid fetching one past the end of translate()'s "to" parameter. 2023-03-01 11:30:17 -05:00
orderedsetaggs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
partitionfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
pg_locale.c Initial pgindent and pgperltidy run for v14. 2021-05-12 13:14:10 -04:00
pg_lsn.c Simplify printing of LSNs 2021-02-23 10:27:02 +01:00
pg_upgrade_support.c Revert per-index collation version tracking feature. 2021-05-07 21:10:11 +12:00
pgstatfuncs.c Fix NULL input behaviour of pg_stat_get_replication_slot(). 2022-03-27 21:44:39 -07:00
pseudotypes.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
quote.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
rangetypes.c doc: 1-byte varlena headers can be used for user PLAIN storage 2023-10-31 09:10:35 -04:00
rangetypes_gist.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
rangetypes_selfuncs.c Fix wording 2021-08-06 20:56:18 +02:00
rangetypes_spgist.c Fix wording 2021-08-06 20:56:18 +02:00
rangetypes_typanalyze.c Invent qsort_interruptible(). 2022-07-12 16:30:36 -04:00
regexp.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
regproc.c Reconsider the handling of procedure OUT parameters. 2021-06-10 17:11:36 -04:00
ri_triggers.c Initial pgindent and pgperltidy run for v14. 2021-05-12 13:14:10 -04:00
rowtypes.c Initial pgindent and pgperltidy run for v14. 2021-05-12 13:14:10 -04:00
ruleutils.c Track nesting depth correctly when drilling down into RECORD Vars. 2023-09-15 17:01:26 -04:00
selfuncs.c YA attempt at taming worst-case behavior of get_actual_variable_range. 2022-11-22 14:40:45 -05:00
tid.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
timestamp.c Revert "Disallow infinite endpoints in generate_series() for timestamps." 2022-05-09 11:40:40 -04:00
trigfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsginidx.c Convert tsginidx.c's GIN indexing logic to fully ternary operation. 2021-02-16 12:07:14 -05:00
tsgistidx.c Fix out-of-bound read in gtsvector_picksplit() 2023-09-04 14:55:53 +09:00
tsquery.c Improve error message about valid value for distance in phrase operator. 2021-08-25 11:45:12 +09:00
tsquery_cleanup.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsquery_gist.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsquery_op.c Avoid using ambiguous word "non-negative" in error messages. 2021-07-28 01:21:35 +09:00
tsquery_rewrite.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsquery_util.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsrank.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
tsvector.c Fix datalen calculation in tsvectorrecv(). 2023-10-01 13:17:11 -04:00
tsvector_op.c Add comments and a missing CHECK_FOR_INTERRUPTS in ts_headline. 2022-11-21 17:07:07 -05:00
tsvector_parser.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
uuid.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
varbit.c Add bit_count SQL function 2021-03-23 10:13:58 +01:00
varchar.c Fix memory leak for hashing with nondeterministic collations. 2022-12-01 11:53:53 -08:00
varlena.c Preserve memory context of VarStringSortSupport buffers. 2022-08-14 12:05:27 -04:00
version.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
windowfuncs.c Update copyright for 2021 2021-01-02 13:06:25 -05:00
xid.c Fix ordering of XIDs in ProcArrayApplyRecoveryInfo 2022-01-27 20:15:37 +01:00
xid8funcs.c Fix visibility check when XID is committed in CLOG but not in procarray. 2022-06-27 08:24:30 +03:00
xml.c Don't crash if cursor_to_xmlschema is used on a non-data-returning Portal. 2023-09-18 14:27:47 -04:00