From: Tom Lane <tgl@sss.pgh.pa.us>
To: tharakan@gmail.com
cc: pgsql-bugs@lists.postgresql.org, Masahiko Sawada <sawada.mshk@gmail.com>,
        Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
Subject: Re: BUG #18828: Crash when pg_get_logical_snapshot_meta() passed
 empty string
In-reply-to: <18828-0f4701c635064211@postgresql.org>
References: <18828-0f4701c635064211@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Sat, 01 Mar 2025 18:41:19 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3068025.1740862032.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 01 Mar 2025 15:47:12 -0500
Message-ID: <3068026.1740862032@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3068026.1740862032%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> Passing an empty string to the recently added extension function
> pg_get_logical_snapshot_meta() triggers PANIC / Abort.

Thanks for noticing.  It looks like this function is far too trusting
of its input.  Another way to crash it is to point to a directory:

regression=3D# SELECT pg_get_logical_snapshot_meta('../snapshots');
PANIC:  could not open file "pg_logical/snapshots/../snapshots": Is a dire=
ctory
server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.

This example incidentally shows that it's not sanitizing the request
to prevent reference to files outside the snapshots directory, which
possibly would be a security bug down the road.  I realize that we
restrict access to the function, but still we shouldn't be *this*
trusting of the argument.

Possibly some of the defense for this ought to be in
SnapBuildRestoreSnapshot: it looks like that function isn't
considering the possibility that OpenTransientFile will succeed on a
directory.  Does it have any other callers passing
less-than-fully-trustworthy paths?

Another interesting question is why the error is being promoted
to PANIC.  That sure seems unnecessary, and there's a comment
in SnapBuildRestoreSnapshot that claims it won't happen.

			regards, tom lane