postgres.git / summary / log / commit / refs

commit    83c3115dd0dda495d8cbe47c5eea33df13f2881e
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sat Feb 21 17:59:25 2015 +0000
First released in: 9.5.0, 9.2.11, 9.3.7, 9.4.2

    Fix misparsing of empty value in conninfo_uri_parse_params().
    
    After finding an "=" character, the pointer was advanced twice when it
    should only advance once.  This is harmless as long as the value after "="
    has at least one character; but if it doesn't, we'd miss the terminator
    character and include too much in the value.
    
    In principle this could lead to reading off the end of memory.  It does not
    seem worth treating as a security issue though, because it would happen on
    client side, and besides client logic that's taking conninfo strings from
    untrusted sources has much worse security problems than this.
    
    Report and patch received off-list from Thomas Fanghaenel.
    Back-patch to 9.2 where the faulty code was introduced.


 src/interfaces/libpq/fe-connect.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
index 65beaf3c880..30f3c539d42 100644
--- a/src/interfaces/libpq/fe-connect.c
+++ b/src/interfaces/libpq/fe-connect.c
@@ -4959,9 +4959,8 @@ conninfo_uri_parse_params(char *params,
 					++p;
 				break;
 			}
-
-			/* Advance, NUL is checked in the 'if' above */
-			++p;
+			else
+				++p;			/* Advance over all other bytes. */
 		}
 
 		keyword = conninfo_uri_decode(keyword, errorMessage);


[parent: c86f8f3615c4]