From: sean <zoulx1982@163.com>
To: Noah Misch <noah@leadboat.com>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re:pgsql: With GB18030, prevent SIGSEGV from reading past end of allocatio
Date: Wed, 14 May 2025 16:38:06 +0800 (CST)
Message-ID: <3674cec2.7edf.196cdf19dbf.Coremail.zoulx1982@163.com> (raw)
In-Reply-To: <E1uBuN8-000FUw-2N@gemulon.postgresql.org>
References: <E1uBuN8-000FUw-2N@gemulon.postgresql.org>
Hi Noah Misch,
I read the patch you commit to pgsql, and i found there also some other routine which
will still call pg_encoding_mblen to get char length.
I have no idea why these routine don't have to replaced by call pg_encoding_mblen_or_incomplete?
And how can i do to reproduce this crash?
Thank you for your time.
Regards.
At 2025-05-09 01:33:58, "Noah Misch" <noah@leadboat.com> wrote:
>With GB18030, prevent SIGSEGV from reading past end of allocation.
>
>With GB18030 as source encoding, applications could crash the server via
>SQL functions convert() or convert_from(). Applications themselves
>could crash after passing unterminated GB18030 input to libpq functions
>PQescapeLiteral(), PQescapeIdentifier(), PQescapeStringConn(), or
>PQescapeString(). Extension code could crash by passing unterminated
>GB18030 input to jsonapi.h functions. All those functions have been
>intended to handle untrusted, unterminated input safely.
>
>A crash required allocating the input such that the last byte of the
>allocation was the last byte of a virtual memory page. Some malloc()
>implementations take measures against that, making the SIGSEGV hard to
>reach. Back-patch to v13 (all supported versions).
>
>Author: Noah Misch <noah@leadboat.com>
>Author: Andres Freund <andres@anarazel.de>
>Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
>Backpatch-through: 13
>Security: CVE-2025-4207
>
>Branch
>------
>REL_15_STABLE
>
>Details
>-------
>https://git.postgresql.org/pg/commitdiff/44ba3f55f552b56b2fbefae028fcf3ea5b53461d
>
>Modified Files
>--------------
>src/backend/utils/mb/mbutils.c | 18 ++++--
>src/common/jsonapi.c | 7 ++-
>src/common/wchar.c | 51 +++++++++++++--
>src/include/mb/pg_wchar.h | 2 +
>src/interfaces/libpq/fe-exec.c | 6 +-
>src/interfaces/libpq/fe-misc.c | 15 ++---
>src/test/modules/test_escape/test_escape.c | 99 ++++++++++++++++++++++++++++++
>src/test/regress/expected/conversion.out | 13 ++--
>src/test/regress/sql/conversion.sql | 7 ++-
>9 files changed, 188 insertions(+), 30 deletions(-)
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: zoulx1982@163.com, noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re:pgsql: With GB18030, prevent SIGSEGV from reading past end of allocatio
In-Reply-To: <3674cec2.7edf.196cdf19dbf.Coremail.zoulx1982@163.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox