From: Peter Eisentraut <peter@eisentraut.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix strsep() use for SCRAM secrets parsing
Date: Fri, 18 Oct 2024 09:26:06 +0000
Message-ID: <E1t1jFG-001MBH-GF@gemulon.postgresql.org> (raw)
Fix strsep() use for SCRAM secrets parsing
The previous code (from commit 5d2e1cc117b) did not detect end of
string correctly, so it would fail to error out if fewer than the
expected number of fields were present, which could then later lead to
a crash when NULL string pointers are accessed.
Reported-by: Alexander Lakhin <exclusion@gmail.com>
Reported-by: Ranier Vilela <ranier.vf@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/79692bf9-17d3-41e6-b9c9-fc8c3944222a@eisentraut.org
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/24a36f91e32d6cbb8182c4cc6529d6e47587c988
Modified Files
--------------
src/backend/libpq/auth-scram.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: peter@eisentraut.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix strsep() use for SCRAM secrets parsing
In-Reply-To: <E1t1jFG-001MBH-GF@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox