diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2017-08-07 10:19:01 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2017-08-07 10:19:22 -0400 |
| commit | f1cda6d6cbb2b551331802cab57957fa5307cf2c (patch) | |
| tree | 7da145bc52d84c8413028bb7a5a2f56b7476359e /src/backend/utils/adt/arrayutils.c | |
| parent | b6e39ca92eeee4e5fa0e83ce3e04dad82559983f (diff) | |
| download | postgresql-f1cda6d6cbb2b551331802cab57957fa5307cf2c.tar.gz postgresql-f1cda6d6cbb2b551331802cab57957fa5307cf2c.zip | |
Require update permission for the large object written by lo_put().
lo_put() surely should require UPDATE permission, the same as lowrite(),
but it failed to check for that, as reported by Chapman Flack. Oversight
in commit c50b7c09d; backpatch to 9.4 where that was introduced.
Tom Lane and Michael Paquier
Security: CVE-2017-7548
Diffstat (limited to 'src/backend/utils/adt/arrayutils.c')
0 files changed, 0 insertions, 0 deletions