From: Tom Lane <tgl@sss.pgh.pa.us>
To: tharakan@gmail.com
Cc: pgsql-bugs@lists.postgresql.org, Masahiko Sawada <sawada.mshk@gmail.com>
Cc: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
Subject: Re: BUG #18828: Crash when pg_get_logical_snapshot_meta() passed empty string
Date: Sat, 01 Mar 2025 15:47:12 -0500
Message-ID: <3068026.1740862032@sss.pgh.pa.us> (raw)
In-Reply-To: <18828-0f4701c635064211@postgresql.org>
References: <18828-0f4701c635064211@postgresql.org>
PG Bug reporting form <noreply@postgresql.org> writes:
> Passing an empty string to the recently added extension function
> pg_get_logical_snapshot_meta() triggers PANIC / Abort.
Thanks for noticing. It looks like this function is far too trusting
of its input. Another way to crash it is to point to a directory:
regression=# SELECT pg_get_logical_snapshot_meta('../snapshots');
PANIC: could not open file "pg_logical/snapshots/../snapshots": Is a directory
server closed the connection unexpectedly
This probably means the server terminated abnormally
before or while processing the request.
This example incidentally shows that it's not sanitizing the request
to prevent reference to files outside the snapshots directory, which
possibly would be a security bug down the road. I realize that we
restrict access to the function, but still we shouldn't be *this*
trusting of the argument.
Possibly some of the defense for this ought to be in
SnapBuildRestoreSnapshot: it looks like that function isn't
considering the possibility that OpenTransientFile will succeed on a
directory. Does it have any other callers passing
less-than-fully-trustworthy paths?
Another interesting question is why the error is being promoted
to PANIC. That sure seems unnecessary, and there's a comment
in SnapBuildRestoreSnapshot that claims it won't happen.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, tharakan@gmail.com, sawada.mshk@gmail.com, bertranddrouvot.pg@gmail.com
Subject: Re: BUG #18828: Crash when pg_get_logical_snapshot_meta() passed empty string
In-Reply-To: <3068026.1740862032@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox