rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
postgresql/src/include
History
Tom Lane 3bc6bc3ee2 Detect integer overflow while computing new array dimensions. 
array_set_element() and related functions allow an array to be
enlarged by assigning to subscripts outside the current array bounds.
While these places were careful to check that the new bounds are
allowable, they neglected to consider the risk of integer overflow
in computing the new bounds.  In edge cases, we could compute new
bounds that are invalid but get past the subsequent checks,
allowing bad things to happen.  Memory stomps that are potentially
exploitable for arbitrary code execution are possible, and so is
disclosure of server memory.

To fix, perform the hazardous computations using overflow-detecting
arithmetic routines, which fortunately exist in all still-supported
branches.

The test cases added for this generate (after patching) errors that
mention the value of MaxArraySize, which is platform-dependent.
Rather than introduce multiple expected-files, use psql's VERBOSITY
parameter to suppress the printing of the message text.  v11 psql
lacks that parameter, so omit the tests in that branch.

Our thanks to Pedro Gallegos for reporting this problem.

Security: CVE-2023-5869
 		2023-11-06 10:56:43 -05:00
..
access Fix btmarkpos/btrestrpos array key wraparound bug. 2023-09-28 16:29:32 -07:00
backup Move basebackup code to new directory src/backend/backup 2022-08-10 14:03:09 -04:00
bootstrap Apply PGDLLIMPORT markings broadly. 2022-04-08 08:16:38 -04:00
catalog Dissociate btequalimage() from interval_ops, ending its deduplication. 2023-10-14 16:33:54 -07:00
commands Fix concurrent update issues with MERGE. 2023-03-13 10:23:42 +00:00
common Expand palloc/pg_malloc API for more type safety 2022-09-14 06:04:24 +02:00
datatype Fix overflow hazards in interval input and output conversions. 2022-04-02 16:12:29 -04:00
executor Fix misbehavior of EvalPlanQual checks with multiple result relations. 2023-05-19 14:26:34 -04:00
fe_utils Allow db.schema.table patterns, but complain about random garbage. 2022-04-20 11:37:29 -04:00
foreign Update copyright for 2022 2022-01-07 19:04:57 -05:00
jit jit: Supply LLVMGlobalGetValueType() for LLVM < 8. 2023-10-19 03:03:27 +13:00
lib Fix type of iterator variable in SH_START_ITERATE 2023-07-06 09:57:31 -07:00
libpq Fix handling of SCRAM-SHA-256's channel binding with RSA-PSS certificates 2023-02-15 10:12:31 +09:00
mb Apply PGDLLIMPORT markings broadly. 2022-04-08 08:16:38 -04:00
nodes Fix problems when a plain-inheritance parent table is excluded. 2023-10-24 14:48:34 -04:00
optimizer Disallow replacing joins with scans in problematic cases. 2023-07-28 15:45:02 +09:00
parser Avoid unnecessary plancache revalidation of utility statements. 2023-08-24 12:02:40 -04:00
partitioning Refactor and cleanup runtime partition prune code a little 2022-04-05 11:46:48 +02:00
port Fix detection of unseekable files for fseek() and ftello() with MSVC 2023-04-12 09:09:53 +09:00
portability Update copyright for 2022 2022-01-07 19:04:57 -05:00
postmaster Un-revert "Disable STARTUP_PROGRESS_TIMEOUT in standby mode." 2023-02-10 16:27:05 -05:00
regex Update copyright for 2022 2022-01-07 19:04:57 -05:00
replication Fix the display of UNKNOWN message type in apply worker. 2023-07-25 08:50:37 +05:30
rewrite Fix calculation of which GENERATED columns need to be updated. 2023-01-05 14:12:17 -05:00
snowball Update copyright for 2022 2022-01-07 19:04:57 -05:00
statistics Add stxdinherit flag to pg_statistic_ext_data 2022-01-16 13:38:01 +01:00
storage Improve heuristics for compressing the KnownAssignedXids array. 2022-11-29 15:43:17 -05:00
tcop Allow event trigger table_rewrite for ALTER MATERIALIZED VIEW 2022-08-17 14:55:24 +09:00
tsearch Add comments and a missing CHECK_FOR_INTERRUPTS in ts_headline. 2022-11-21 17:07:07 -05:00
utils Detect integer overflow while computing new array dimensions. 2023-11-06 10:56:43 -05:00
.gitignore Refactor dlopen() support 2018-09-06 11:33:04 +02:00
Makefile Build in some knowledge about foreign-key relationships in the catalogs. 2021-02-02 17:11:55 -05:00
c.h perl: Hide warnings inside perl.h when using gcc compatible compiler 2023-01-02 15:49:33 -08:00
fmgr.h Pre-beta mechanical code beautification. 2022-05-12 15:17:30 -04:00
funcapi.h Rename SetSingleFuncCall() to InitMaterializedSRF() 2022-10-18 10:22:40 +09:00
getaddrinfo.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
getopt_long.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
miscadmin.h Process session_preload_libraries within InitPostgres's transaction. 2022-07-25 10:27:43 -04:00
pg_config.h.in Fix handling of SCRAM-SHA-256's channel binding with RSA-PSS certificates 2023-02-15 10:12:31 +09:00
pg_config_ext.h.in Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
pg_config_manual.h Fix old-fd issues using global barriers everywhere. 2022-05-07 16:47:29 +12:00
pg_getopt.h Apply PGDLLIMPORT markings broadly. 2022-04-08 08:16:38 -04:00
pg_trace.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
pgstat.h Fix assertion failure when updating stats_fetch_consistency in a transaction 2023-05-10 11:24:40 +09:00
pgtar.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
pgtime.h Apply PGDLLIMPORT markings broadly. 2022-04-08 08:16:38 -04:00
port.h pg_basebackup: Fix cross-platform tablespace relocation. 2022-10-21 08:31:39 -04:00
postgres.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
postgres_ext.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
postgres_fe.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
rusagestub.h Update copyright for 2022 2022-01-07 19:04:57 -05:00
windowapi.h Update copyright for 2022 2022-01-07 19:04:57 -05:00