From: Daniel Gustafsson <dgustafsson@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Protect against small overread in SASLprep validation
Date: Tue, 10 Sep 2024 09:27:04 +0000
Message-ID: <E1snx9M-000QHm-18@gemulon.postgresql.org> (raw)
Protect against small overread in SASLprep validation
In case of torn UTF8 in the input data we might end up going
past the end of the string since we don't account for length.
While validation won't be performed on a sequence with a NULL
byte it's better to avoid going past the end to beging with.
Fix by taking the length into consideration.
Author: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Discussion: https://postgr.es/m/CAOYmi+mTnmM172g=_+Yvc47hzzeAsYPy2C4UBY3HK9p-AXNV0g@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/390b3cbbb2af3c749587b0697c01c94e0e173510
Modified Files
--------------
src/common/saslprep.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: dgustafsson@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Protect against small overread in SASLprep validation
In-Reply-To: <E1snx9M-000QHm-18@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox