diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2012-02-23 15:53:17 -0500 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2012-02-23 15:53:17 -0500 |
| commit | 2d2f63ddccc6a557e7eb35252483fea7fe4a688a (patch) | |
| tree | f1741537ee702ed316be9009d48fb9fb62eac330 /src/backend/access/gist/gistxlog.c | |
| parent | e6fcb03dc0de1771f7d408b5df1738272e6f98e5 (diff) | |
| download | postgresql-2d2f63ddccc6a557e7eb35252483fea7fe4a688a.tar.gz postgresql-2d2f63ddccc6a557e7eb35252483fea7fe4a688a.zip | |
Convert newlines to spaces in names written in pg_dump comments.
pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script. A name containing a newline
would at least render the script syntactically incorrect. Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.
Reported by Heikki Linnakangas, patch by Robert Haas
Security: CVE-2012-0868
Diffstat (limited to 'src/backend/access/gist/gistxlog.c')
0 files changed, 0 insertions, 0 deletions