diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
| commit | 11cc7bb8825efc74c9418f6e88d448cc253c47b0 (patch) | |
| tree | 8046e4ed03a6b3bf5ca63952dc776231b17c225a /src/interfaces/libpq/fe-auth.c | |
| parent | a3c643938166abed9a390cdbd8a5df09bfe39523 (diff) | |
| download | postgresql-11cc7bb8825efc74c9418f6e88d448cc253c47b0.tar.gz postgresql-11cc7bb8825efc74c9418f6e88d448cc253c47b0.zip | |
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
Diffstat (limited to 'src/interfaces/libpq/fe-auth.c')
| -rw-r--r-- | src/interfaces/libpq/fe-auth.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c index a5e3cd2229c..b3c3a86edec 100644 --- a/src/interfaces/libpq/fe-auth.c +++ b/src/interfaces/libpq/fe-auth.c @@ -480,7 +480,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r) { char sysmsg[256]; - if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, + NULL, r, 0, sysmsg, sizeof(sysmsg), NULL) == 0) printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x", mprefix, (unsigned int) r); |