postgres.git / summary / log / commit / refs

commit    6b96aafc67ac80590a8317ec6a0447e95a2b1f66
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Tue Oct 19 10:59:50 2021 +0000
First released in: 9.6.24, 10.19

    Fix sscanf limits in pg_dump
    
    Make sure that the string parsing is limited by the size of the
    destination buffer.
    
    The buffer is bounded by MAXPGPATH, and thus the limit must be
    inserted via preprocessor expansion and the buffer increased by
    one to account for the terminator. There is no risk of overflow
    here, since in this case, the buffer scanned is smaller than the
    destination buffer.
    
    Backpatch all the way down to 9.6.
    
    Reviewed-by: Tom Lane
    Discussion: https://postgr.es/m/B14D3D7B-F98C-4E20-9459-C122C67647FB@yesql.se
    Backpatch-through: 9.6


 src/bin/pg_dump/pg_backup_directory.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/bin/pg_dump/pg_backup_directory.c b/src/bin/pg_dump/pg_backup_directory.c
index 2b3921b43ad..b4fd825a9c9 100644
--- a/src/bin/pg_dump/pg_backup_directory.c
+++ b/src/bin/pg_dump/pg_backup_directory.c
@@ -463,11 +463,11 @@ _LoadBlobs(ArchiveHandle *AH)
 	/* Read the blobs TOC file line-by-line, and process each blob */
 	while ((cfgets(ctx->blobsTocFH, line, MAXPGPATH)) != NULL)
 	{
-		char		fname[MAXPGPATH];
+		char		fname[MAXPGPATH + 1];
 		char		path[MAXPGPATH];
 
 		/* Can't overflow because line and fname are the same length. */
-		if (sscanf(line, "%u %s\n", &oid, fname) != 2)
+		if (sscanf(line, "%u %" CppAsString2(MAXPGPATH) "s\n", &oid, fname) != 2)
 			exit_horribly(modulename, "invalid line in large object TOC file \"%s\": \"%s\"\n",
 						  fname, line);
 


[parent: f49bf8263459]