From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Detect integer overflow while computing new array dimensions.
Date: Mon, 06 Nov 2023 15:57:54 +0000
Message-ID: <E1r01z8-004CB4-CZ@gemulon.postgresql.org> (raw)
Detect integer overflow while computing new array dimensions.
array_set_element() and related functions allow an array to be
enlarged by assigning to subscripts outside the current array bounds.
While these places were careful to check that the new bounds are
allowable, they neglected to consider the risk of integer overflow
in computing the new bounds. In edge cases, we could compute new
bounds that are invalid but get past the subsequent checks,
allowing bad things to happen. Memory stomps that are potentially
exploitable for arbitrary code execution are possible, and so is
disclosure of server memory.
To fix, perform the hazardous computations using overflow-detecting
arithmetic routines, which fortunately exist in all still-supported
branches.
The test cases added for this generate (after patching) errors that
mention the value of MaxArraySize, which is platform-dependent.
Rather than introduce multiple expected-files, use psql's VERBOSITY
parameter to suppress the printing of the message text. v11 psql
lacks that parameter, so omit the tests in that branch.
Our thanks to Pedro Gallegos for reporting this problem.
Security: CVE-2023-5869
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/e24daa94b2a747a95987569ef1899f74dbaf8495
Modified Files
--------------
src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++--------
src/backend/utils/adt/arrayutils.c | 6 ---
src/include/utils/array.h | 7 +++
src/test/regress/expected/arrays.out | 17 ++++++++
src/test/regress/sql/arrays.sql | 19 ++++++++
5 files changed, 110 insertions(+), 24 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Detect integer overflow while computing new array dimensions.
In-Reply-To: <E1r01z8-004CB4-CZ@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox