diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:58 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:58 -0400 |
| commit | 6cd30292bfc38edcae0c1d9c127265cfe665a569 (patch) | |
| tree | abad4920c68ccfc51b99427f716bd58ccf53c013 | |
| parent | 158a0fb254578e93cec7a940c780426217b79343 (diff) | |
| download | postgresql-6cd30292bfc38edcae0c1d9c127265cfe665a569.tar.gz postgresql-6cd30292bfc38edcae0c1d9c127265cfe665a569.zip | |
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
| -rw-r--r-- | src/backend/libpq/auth.c | 4 | ||||
| -rw-r--r-- | src/backend/port/win32/socket.c | 4 | ||||
| -rw-r--r-- | src/interfaces/libpq/fe-auth.c | 4 | ||||
| -rw-r--r-- | src/port/dirmod.c | 8 |
4 files changed, 15 insertions, 5 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index e70f4729aff..8c6ff8e6efc 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1226,7 +1226,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r) { char sysmsg[256]; - if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, + NULL, r, 0, sysmsg, sizeof(sysmsg), NULL) == 0) ereport(severity, (errmsg_internal("%s", errmsg), diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c index 5ec9cc29cba..658463000fb 100644 --- a/src/backend/port/win32/socket.c +++ b/src/backend/port/win32/socket.c @@ -656,7 +656,9 @@ pgwin32_socket_strerror(int err) } ZeroMemory(&wserrbuf, sizeof(wserrbuf)); - if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM | + FORMAT_MESSAGE_FROM_HMODULE, handleDLL, err, MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index e3612e54b7b..23333e66fcf 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -480,7 +480,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r) { char sysmsg[256]; - if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, + NULL, r, 0, sysmsg, sizeof(sysmsg), NULL) == 0) printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x", mprefix, (unsigned int) r); diff --git a/src/port/dirmod.c b/src/port/dirmod.c index f61d68b301a..280d6847a57 100644 --- a/src/port/dirmod.c +++ b/src/port/dirmod.c @@ -273,7 +273,9 @@ pgsymlink(const char *oldpath, const char *newpath) LPSTR msg; errno = 0; - FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, + FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR) &msg, 0, NULL); @@ -348,7 +350,9 @@ pgreadlink(const char *path, char *buf, size_t size) LPSTR msg; errno = 0; - FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, + FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR) &msg, 0, NULL); |