diff options
| author | Michael Paquier <michael@paquier.xyz> | 2020-07-22 14:52:50 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2020-07-22 14:52:50 +0900 |
| commit | eceb415c6ff0eb2494f90397433a966a182f3908 (patch) | |
| tree | 9dca3e40d3aaed9f3311ea4247afd0278981c99e /contrib/pgcrypto/pgp-compress.c | |
| parent | 22b96f883fe2a454476b4d5fd69ee46b15889169 (diff) | |
| download | postgresql-eceb415c6ff0eb2494f90397433a966a182f3908.tar.gz postgresql-eceb415c6ff0eb2494f90397433a966a182f3908.zip | |
Fix corner case with PGP decompression in pgcrypto
A compressed stream may end with an empty packet, and PGP decompression
finished before reading this empty packet in the remaining stream. This
caused a failure in pgcrypto, handling this case as corrupted data.
This commit makes sure to consume such extra data, avoiding a failure
when decompression the entire stream. This corner case was reproducible
with a data length of 16kB, and existed since its introduction in
e94dd6a. A cheap regression test is added to cover this case.
Thanks to Jeff Janes for the extra investigation.
Reported-by: Frank Gagnepain
Author: Kyotaro Horiguchi, Michael Paquier
Discussion: https://postgr.es/m/16476-692ef7b84e5fb893@postgresql.org
Backpatch-through: 9.5
Diffstat (limited to 'contrib/pgcrypto/pgp-compress.c')
| -rw-r--r-- | contrib/pgcrypto/pgp-compress.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/contrib/pgcrypto/pgp-compress.c b/contrib/pgcrypto/pgp-compress.c index 57efe733386..631caa13693 100644 --- a/contrib/pgcrypto/pgp-compress.c +++ b/contrib/pgcrypto/pgp-compress.c @@ -244,6 +244,17 @@ decompress_read(void *priv, PullFilter *src, int len, struct DecomprData *dec = priv; restart: + if (dec->stream.avail_in == 0) + { + uint8 *tmp; + + res = pullf_read(src, 8192, &tmp); + if (res < 0) + return res; + dec->stream.next_in = tmp; + dec->stream.avail_in = res; + } + if (dec->buf_data > 0) { if (len > dec->buf_data) @@ -257,17 +268,6 @@ restart: if (dec->eof) return 0; - if (dec->stream.avail_in == 0) - { - uint8 *tmp; - - res = pullf_read(src, 8192, &tmp); - if (res < 0) - return res; - dec->stream.next_in = tmp; - dec->stream.avail_in = res; - } - dec->stream.next_out = dec->buf; dec->stream.avail_out = dec->buf_len; dec->pos = dec->buf; |