Received: from malur.postgresql.org ([2a02:16a8:dc51::56])
	by arkaria.postgresql.org with esmtps
 (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1fyLpg-0003uH-FT
	for pgsql-bugs@arkaria.postgresql.org; Fri, 07 Sep 2018 18:50:16 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1fyLpc-0006ze-Dn
	for pgsql-bugs@arkaria.postgresql.org; Fri, 07 Sep 2018 18:50:12 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <code@jeremyevans.net>)
	id 1fyLpc-0006zV-7v
	for pgsql-bugs@lists.postgresql.org; Fri, 07 Sep 2018 18:50:12 +0000
Received: from smtp-out-2.mxes.net ([67.222.241.118])
	by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.89)
	(envelope-from <code@jeremyevans.net>)
	id 1fyLpZ-0001zc-7Z
	for pgsql-bugs@lists.postgresql.org; Fri, 07 Sep 2018 18:50:11 +0000
Received: from Customer-MUA (mua.mxes.net [10.0.0.1])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.mxes.net (Postfix) with ESMTPSA id DE44A2755C;
	Fri,  7 Sep 2018 14:50:05 -0400 (EDT)
Received: from jeremyevans.local (battleground.jeremyevans.local [10.187.8.1])
	by battleground.jeremyevans.local (OpenSMTPD) with ESMTPS id 7823c87d
 (TLSv1.2:ECDHE-RSA-CHACHA20-POLY1305:256:NO);
	Fri, 7 Sep 2018 11:50:04 -0700 (PDT)
Date: Fri, 7 Sep 2018 11:50:03 -0700
From: Jeremy Evans <code@jeremyevans.net>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #15367: Crash in pg_fe_scram_free when using foreign tables
Message-ID: <20180907185003.GJ17425@jeremyevans.local>
References: <153626613985.23143.4743626885618266803@wrigleys.postgresql.org>
 <20180906215836.GP2726@paquier.xyz>
 <20180906222843.GF17425@jeremyevans.local>
 <20180907165103.GH17425@jeremyevans.local>
 <20180907175518.GI17425@jeremyevans.local>
 <20180907181522.GB32058@paquier.xyz>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180907181522.GB32058@paquier.xyz>
User-Agent: Mutt/1.10.1 (2018-07-13)
X-Sent-To: <cGdzcWwtYnVnc0BsaXN0cy5wb3N0Z3Jlc3FsLm9yZw==>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Precedence: bulk

On 09/07 11:15, Michael Paquier wrote:
> On Fri, Sep 07, 2018 at 10:55:18AM -0700, Jeremy Evans wrote:
> > Here's the backtrace:
> > 
> > #5  0x000017c20a6b8b00 in pg_fe_scram_free (opaq=0x17c223712000) at fe-auth-scram.c:127
> > #6  0x000017c20a6b9d20 in pqDropConnection (conn=0x17c1dac61800, flushInput=1 '\001') at fe-connect.c:479
> > #7  0x000017c20a6bf95e in closePGconn (conn=0x17c1dac61800) at fe-connect.c:3710
> >
> > Hopefully this helps.  If you need more information, please let me know.
> 
> Thanks.  This fails when freeing the password field in fe_scram_state.
> I have a question: does your password use non-ASCII characters which
> could make SASLprep to be run on the password string?  The result string
> from pg_saslprep allocates a new string for any results returned by
> reading the code, I am wondering if we could be missing something..

No, the user mapping password is comprised of hex-ascii characters: [0-9a-f]{16}

In case it helps, here's the content of opaq from gdb (with the specific
strings cleared).

print *((fe_scram_state *) opaq)
{
  state = FE_SCRAM_FINISHED,
  username = 0x17c267526380 "...",
  password = 0x17c1ee153398 <Address 0x17c1ee153398 out of bounds>,
  SaltedPassword = 0x17c223712018 "...",
  client_nonce = 0x17c267529f60 "...",
  client_first_message_bare = 0x17c223711da0 "...",
  client_final_message_without_proof = 0x17c271ca19c0 "...",
  server_first_message = 0x17c1ea48a400 "...",
  salt = 0x17c2675261c0 "...",
  saltlen = 16,
  iterations = 4096,
  nonce = 0x17c2179e9880 "...",
  server_final_message = 0x17c271ca1a40 "...",
  ServerSignature = 0x17c223712078 "..."
}

Thanks,
Jeremy