diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
| commit | 491e847380740dac54d4ecae820261bbaa8aee44 (patch) | |
| tree | 15f8d8fb2780314b8b0d235c2b9a2f8f5bdcdea8 /src/backend/port | |
| parent | 978894a41f335ccd21140c559ecdc22f42d2f142 (diff) | |
| download | postgresql-491e847380740dac54d4ecae820261bbaa8aee44.tar.gz postgresql-491e847380740dac54d4ecae820261bbaa8aee44.zip | |
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
Diffstat (limited to 'src/backend/port')
| -rw-r--r-- | src/backend/port/win32/socket.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c index cfbfa2d6e97..d62fe67dd4e 100644 --- a/src/backend/port/win32/socket.c +++ b/src/backend/port/win32/socket.c @@ -658,7 +658,9 @@ pgwin32_socket_strerror(int err) } ZeroMemory(&wserrbuf, sizeof(wserrbuf)); - if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM | + FORMAT_MESSAGE_FROM_HMODULE, handleDLL, err, MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), |