public inbox for [email protected]  

help / color / mirror / Atom feed

From: PG Bug reporting form <[email protected]>
To: [email protected]
Cc: [email protected]
Subject: BUG #19422: Malformed raius packet
Date: Mon, 02 Mar 2026 09:04:14 +0000
Message-ID: <[email protected]> (raw)

The following bug has been logged on the website:

Bug reference:      19422
Logged by:          Stanislav Osipov
Email address:      [email protected]
PostgreSQL version: 18.3
Operating system:   Ubuntu 22
Description:        

User can create malformed radius packet by sending username, which length is
>253
This is would lead to overwriting raidius attributes without causing
security consequences

Due to calling radius_add_attribute at PerformRadiusTransaction:
[https://github.com/postgres/postgres/blob/386ca3908de28dd882a62b8f97a329db07b23138/src/backend/libpq...]

radius_add_attribute(packet, RADIUS_USER_NAME, (const unsigned char *)
user_name, strlen(user_name));
[https://github.com/postgres/postgres/blob/386ca3908de28dd882a62b8f97a329db07b23138/src/backend/libpq...]
{...
        attr = (radius_attribute *) ((unsigned char *) packet +
packet->length);
        attr->attribute = type;
        attr->length = len + 2;         /* total size includes type and
length */
        memcpy(attr->data, data, len);
        packet->length += attr->length;
}

User may overflow attr->length (uint8) by sending user_name with length of
254 that would led to overwriting user_name attribute and to incorrect
computation of packet->length by next call of radius_add_attribute
[https://github.com/postgres/postgres/blob/386ca3908de28dd882a62b8f97a329db07b23138/src/backend/libpq...]
Even though it overflows only in bounds of array, it may have negative
affect in the future.

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: BUG #19422: Malformed raius packet
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox