diff options
| author | Marc G. Fournier <scrappy@hub.org> | 1997-02-13 08:06:36 +0000 |
|---|---|---|
| committer | Marc G. Fournier <scrappy@hub.org> | 1997-02-13 08:06:36 +0000 |
| commit | 809ae06ab2fa2c8c442582b06e459bcf63554310 (patch) | |
| tree | a8e8755526375bf903dccc69c465d6e5f4dd9816 /src | |
| parent | d937b4efdbeead812658eb119186e83c038aeacb (diff) | |
| download | postgresql-809ae06ab2fa2c8c442582b06e459bcf63554310.tar.gz postgresql-809ae06ab2fa2c8c442582b06e459bcf63554310.zip | |
Patch for:
The following patch to src/backend/libpq/pqpacket.c provides additional
checking for bad packet length data. It was tested with the Linux telnet
client, with netcat using the numbers.txt and by dumping random numbers
into the port.
Patch by: Alvaro Martinez Echevarria <alvaro@lander.es>
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/pqpacket.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/src/backend/libpq/pqpacket.c b/src/backend/libpq/pqpacket.c index 5b2ce7e6ad3..eddeb97040a 100644 --- a/src/backend/libpq/pqpacket.c +++ b/src/backend/libpq/pqpacket.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/libpq/Attic/pqpacket.c,v 1.2 1996/11/06 08:48:31 scrappy Exp $ + * $Header: /cvsroot/pgsql/src/backend/libpq/Attic/pqpacket.c,v 1.3 1997/02/13 08:06:36 scrappy Exp $ * *------------------------------------------------------------------------- */ @@ -125,6 +125,22 @@ PacketReceive(Port *port, /* receive port */ } } else { /* + * This is an attempt to shield the Postmaster + * from mallicious attacks by placing tighter + * restrictions on the reported packet length. + * + * Check for negative packet length + */ + if ((buf->len) <= 0) { + return(STATUS_INVALID); + } + /* + * Check for oversize packet + */ + if ((ntohl(buf->len)) > max_size) { + return(STATUS_INVALID); + } + /* * great. got the header. now get the true length (including * header size). */ |