diff options
| author | Michael Paquier <michael@paquier.xyz> | 2020-07-22 14:52:36 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2020-07-22 14:52:36 +0900 |
| commit | 35e142202b14fa12f8edbd7e58b33c39d3c03c62 (patch) | |
| tree | 49e9edd541a4d90eef5888b7171aaa497a1817d4 /contrib/pgcrypto/pgp-compress.c | |
| parent | cc4dd2a7af13b4759cd76074a932c8cf24e32bb2 (diff) | |
| download | postgresql-35e142202b14fa12f8edbd7e58b33c39d3c03c62.tar.gz postgresql-35e142202b14fa12f8edbd7e58b33c39d3c03c62.zip | |
Fix corner case with PGP decompression in pgcrypto
A compressed stream may end with an empty packet, and PGP decompression
finished before reading this empty packet in the remaining stream. This
caused a failure in pgcrypto, handling this case as corrupted data.
This commit makes sure to consume such extra data, avoiding a failure
when decompression the entire stream. This corner case was reproducible
with a data length of 16kB, and existed since its introduction in
e94dd6a. A cheap regression test is added to cover this case.
Thanks to Jeff Janes for the extra investigation.
Reported-by: Frank Gagnepain
Author: Kyotaro Horiguchi, Michael Paquier
Discussion: https://postgr.es/m/16476-692ef7b84e5fb893@postgresql.org
Backpatch-through: 9.5
Diffstat (limited to 'contrib/pgcrypto/pgp-compress.c')
| -rw-r--r-- | contrib/pgcrypto/pgp-compress.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/contrib/pgcrypto/pgp-compress.c b/contrib/pgcrypto/pgp-compress.c index 0505bdee923..17f5b2ef93d 100644 --- a/contrib/pgcrypto/pgp-compress.c +++ b/contrib/pgcrypto/pgp-compress.c @@ -243,6 +243,17 @@ decompress_read(void *priv, PullFilter *src, int len, struct DecomprData *dec = priv; restart: + if (dec->stream.avail_in == 0) + { + uint8 *tmp; + + res = pullf_read(src, 8192, &tmp); + if (res < 0) + return res; + dec->stream.next_in = tmp; + dec->stream.avail_in = res; + } + if (dec->buf_data > 0) { if (len > dec->buf_data) @@ -256,17 +267,6 @@ restart: if (dec->eof) return 0; - if (dec->stream.avail_in == 0) - { - uint8 *tmp; - - res = pullf_read(src, 8192, &tmp); - if (res < 0) - return res; - dec->stream.next_in = tmp; - dec->stream.avail_in = res; - } - dec->stream.next_out = dec->buf; dec->stream.avail_out = dec->buf_len; dec->pos = dec->buf; |