From 11cc7bb8825efc74c9418f6e88d448cc253c47b0 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Tue, 29 Mar 2016 11:54:57 -0400 Subject: Avoid possibly-unsafe use of Windows' FormatMessage() function. Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag, it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well. Otherwise, if the message contains any %n insertion markers, the function will try to fetch argument strings to substitute --- which we are not passing, possibly leading to a crash. This is exactly analogous to the rule about not giving printf() a format string you're not in control of. Noted and patched by Christian Ullrich. Back-patch to all supported branches. --- src/backend/port/win32/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/backend/port/win32/socket.c') diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c index 697917d4a47..ae3bae4c823 100644 --- a/src/backend/port/win32/socket.c +++ b/src/backend/port/win32/socket.c @@ -657,7 +657,9 @@ pgwin32_socket_strerror(int err) } ZeroMemory(&wserrbuf, sizeof(wserrbuf)); - if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM | + FORMAT_MESSAGE_FROM_HMODULE, handleDLL, err, MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), -- cgit v1.2.3