From: Peter Eisentraut <peter@eisentraut.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: libpq: Fix minor TOCTOU violation
Date: Fri, 16 Aug 2024 04:45:55 +0000
Message-ID: <E1seoqZ-004O2K-89@gemulon.postgresql.org> (raw)
libpq: Fix minor TOCTOU violation
libpq checks the permissions of the password file before opening it.
The way this is done in two separate operations, a static analyzer
would flag as a time-of-check-time-of-use violation. In practice, you
can't do anything with that, but it still seems better style to fix
it.
To fix it, open the file first and then check the permissions on the
opened file handle.
Reviewed-by: Aleksander Alekseev <aleksander@timescale.com>
Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Discussion: https://www.postgresql.org/message-id/flat/a3356054-14ae-4e7a-acc6-249d19dac20b%40eisentraut.org
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/e882bcae032d5e89777e2a1f3d78dfb77c17c192
Modified Files
--------------
src/interfaces/libpq/fe-connect.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: peter@eisentraut.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: libpq: Fix minor TOCTOU violation
In-Reply-To: <E1seoqZ-004O2K-89@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox