diff options
| author | Noah Misch <noah@leadboat.com> | 2015-05-18 10:02:31 -0400 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2015-05-18 10:02:31 -0400 |
| commit | 16304a013432931e61e623c8d85e9fe24709d9ba (patch) | |
| tree | 8744b71d730def0f51abca8d488a4ddc6014144c /src/pl/plpython/plpython.h | |
| parent | cac18a76bb6b08f1ecc2a85e46c9d2ab82dd9d23 (diff) | |
| download | postgresql-16304a013432931e61e623c8d85e9fe24709d9ba.tar.gz postgresql-16304a013432931e61e623c8d85e9fe24709d9ba.zip | |
Add error-throwing wrappers for the printf family of functions.
All known standard library implementations of these functions can fail
with ENOMEM. A caller neglecting to check for failure would experience
missing output, information exposure, or a crash. Check return values
within wrappers and code, currently just snprintf.c, that bypasses the
wrappers. The wrappers do not return after an error, so their callers
need not check. Back-patch to 9.0 (all supported versions).
Popular free software standard library implementations do take pains to
bypass malloc() in simple cases, but they risk ENOMEM for floating point
numbers, positional arguments, large field widths, and large precisions.
No specification demands such caution, so this commit regards every call
to a printf family function as a potential threat.
Injecting the wrappers implicitly is a compromise between patch scope
and design goals. I would prefer to edit each call site to name a
wrapper explicitly. libpq and the ECPG libraries would, ideally, convey
errors to the caller rather than abort(). All that would be painfully
invasive for a back-patched security fix, hence this compromise.
Security: CVE-2015-3166
Diffstat (limited to 'src/pl/plpython/plpython.h')
| -rw-r--r-- | src/pl/plpython/plpython.h | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/src/pl/plpython/plpython.h b/src/pl/plpython/plpython.h index ea540af39e3..0f60af68363 100644 --- a/src/pl/plpython/plpython.h +++ b/src/pl/plpython/plpython.h @@ -35,10 +35,8 @@ * So we undefine them here and redefine them after it's done its dirty deed. */ -#ifdef USE_REPL_SNPRINTF #undef snprintf #undef vsnprintf -#endif #if defined(_MSC_VER) && defined(_DEBUG) /* Python uses #pragma to bring in a non-default libpython on VC++ if @@ -125,7 +123,6 @@ typedef int Py_ssize_t; #include <eval.h> /* put back our snprintf and vsnprintf */ -#ifdef USE_REPL_SNPRINTF #ifdef snprintf #undef snprintf #endif @@ -133,13 +130,12 @@ typedef int Py_ssize_t; #undef vsnprintf #endif #ifdef __GNUC__ -#define vsnprintf(...) pg_vsnprintf(__VA_ARGS__) -#define snprintf(...) pg_snprintf(__VA_ARGS__) +#define vsnprintf(...) vsnprintf_throw_on_fail(__VA_ARGS__) +#define snprintf(...) snprintf_throw_on_fail(__VA_ARGS__) #else -#define vsnprintf pg_vsnprintf -#define snprintf pg_snprintf +#define vsnprintf vsnprintf_throw_on_fail +#define snprintf snprintf_throw_on_fail #endif /* __GNUC__ */ -#endif /* USE_REPL_SNPRINTF */ /* * Used throughout, and also by the Python 2/3 porting layer, so it's easier to |