pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Detect integer overflow while computing new array dimensions. 7+ messages / 1 participants [nested] [flat]
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e24daa94b2a747a95987569ef1899f74dbaf8495 Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_12_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d267cea24ea346c739c85bf7bccbd8e8f59da6b3 Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/18b585155a891784ca8985f595ebc0dde94e0d43 Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3bc6bc3ee2dea4812203b3649096049af97fb13b Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/26c599beb494f490029059a0189a4517d4cf8b50 Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/edc0a8d82a369be2ae6c7e3bea4ae96cff5723f8 Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 +++ src/test/regress/expected/arrays.out | 17 ++++++++ src/test/regress/sql/arrays.sql | 19 ++++++++ 5 files changed, 110 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Detect integer overflow while computing new array dimensions. @ 2023-11-06 15:57 Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 7+ messages in thread From: Tom Lane @ 2023-11-06 15:57 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Detect integer overflow while computing new array dimensions. array_set_element() and related functions allow an array to be enlarged by assigning to subscripts outside the current array bounds. While these places were careful to check that the new bounds are allowable, they neglected to consider the risk of integer overflow in computing the new bounds. In edge cases, we could compute new bounds that are invalid but get past the subsequent checks, allowing bad things to happen. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. To fix, perform the hazardous computations using overflow-detecting arithmetic routines, which fortunately exist in all still-supported branches. The test cases added for this generate (after patching) errors that mention the value of MaxArraySize, which is platform-dependent. Rather than introduce multiple expected-files, use psql's VERBOSITY parameter to suppress the printing of the message text. v11 psql lacks that parameter, so omit the tests in that branch. Our thanks to Pedro Gallegos for reporting this problem. Security: CVE-2023-5869 Branch ------ REL_11_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/c48008f599fd0e3bca2923ff5b40b559ae1e4e2e Modified Files -------------- src/backend/utils/adt/arrayfuncs.c | 85 ++++++++++++++++++++++++++++++-------- src/backend/utils/adt/arrayutils.c | 6 --- src/include/utils/array.h | 7 ++++ 3 files changed, 74 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2023-11-06 15:57 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us> 2023-11-06 15:57 pgsql: Detect integer overflow while computing new array dimensions. Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox