Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 3 Mar 2026 16:20:37 +0900
From: Michael Paquier <michael@paquier.xyz>
To: stasos24@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19422: Malformed raius packet
Message-ID: <aaaLxQySNOxF-lr2@paquier.xyz>
References: <19422-bdaba8a639a0c911@postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="o6thQwzrPtYbA5Rp"
Content-Disposition: inline
In-Reply-To: <19422-bdaba8a639a0c911@postgresql.org>
Archived-At: <https://www.postgresql.org/message-id/aaaLxQySNOxF-lr2%40paquier.xyz>
Precedence: bulk


--o6thQwzrPtYbA5Rp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Mon, Mar 02, 2026 at 09:04:14AM +0000, PG Bug reporting form wrote:
> User may overflow attr->length (uint8) by sending user_name with length of
> 254 that would led to overwriting user_name attribute and to incorrect
> computation of packet->length by next call of radius_add_attribute
> [https://github.com/postgres/postgres/blob/386ca3908de28dd882a62b8f97a329db07b23138/src/backend/libpq/auth.c#L3013]
> Even though it overflows only in bounds of array, it may have negative
> affect in the future.

Fun, due to the increment of 2 added a couple of lines down.  There is
an overflow calculation.  There is nothing critical here.

Looking at RFC 2865, there is nothing about a limit of size for the
attributes.  This means that we are only limited by our
RADIUS_BUFFER_SIZE.  Hence, we could bump radius_attribute.length to
uint16 and add some casts in the check for RADIUS_BUFFER_SIZE so as
we don't overflow the addition before adding an attribute to the
packet?  On the other hand, we could aim for simpler and just reject
any attributes larger than 255 bytes.  I doubt that anybody would be
insane enough to use fields larger than that 255 bytes anyway.  Both
solutions are equal in simplicity here.

Thoughts?
--
Michael

--o6thQwzrPtYbA5Rp
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmmmi8UACgkQnvQgOdby
QH1fTA/9EOAJjqrNsY09d75Ws5OITW+uy+P7QNStrnqa7Arat/skMan/myA7m538
kxAlz4fGhbsshjDuqAi/LMHHMVyJiLz3jbnYtgbJFy2M6m7rbJE8Whlm4aoZjfmV
e2QIW+EcXdMBCK224J2YbPW/C97yux4q79MG80zsnoUOwfhfq0TydNljllSqOGCn
skd3l+AcK97I7v4AKvN6FxpcMHf1n5crJYg6hQxGbMS6VeMquUThq0NSXORX5crw
RPVNO087/MP60U/xHzJazNjKIFF9Yn0amxqAoP3CS+PPR2ynp/7IO0txfk9CZYR8
XVbpEsfV/HUhvCZnPErV+MvSe8DFQSUZB3s6XPCVdP7UfhcovDvLiLMYT8+uAAIK
ZPeOK+NZSCldLmAuW8I9Qa5Ajtx0JehOj4OJsoNbEqhSOLkqN8DSvsiO9jY0Igin
AbvAt/KBoOQHAbgjWilyczu/qU8f5h+wqFC/FE3kbtwcKsRVE5ajIg6AJDhr9EQs
2Z08TviUaPTnlcb6lLTz6WM5fGlgEfs1OwzugRPfMuYfm+QxuhUuoAUxpGA0Qd7B
JKolb+SJDX5rFW/i60bFlKiPivddPeX39Oo8oJ7uZDGiQxdCbzXEY8M8OaEcAJIe
I6G1WzSW1qR8x/Akrflwu2CJkT1i2yBn/c419TFagj4fJfA30G4=
=PiZm
-----END PGP SIGNATURE-----

--o6thQwzrPtYbA5Rp--