From: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: pg_freespacemap: Fix declaration of pg_freespace(regclass)
Date: Wed, 08 Jan 2025 04:18:00 +0000
Message-ID: <E1tVNW3-000RZY-VT@gemulon.postgresql.org> (raw)
pg_freespacemap: Fix declaration of pg_freespace(regclass)
This function called generate_series() without enforcing its input
argument types, making possible for an attacker to catch this call, by
defining for example a generate_series(int,bigint).
The internals of pg_freespace(regclass) are changed to force the use of
bigint for the inputs of generate_series(). A more consistent style is
applied for all its hardcoded values, while on it.
Issue introduced in 3f323eba89fb.
Reported-by: Noah Misch
Reviewed-by: Noah Misch
Discussion: https://postgr.es/m/20250106190428.ec.nmisch@google.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/e0c3d5122e6a4114af3092b7938c9b43d619e62c
Modified Files
--------------
contrib/pg_freespacemap/pg_freespacemap--1.2--1.3.sql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: pg_freespacemap: Fix declaration of pg_freespace(regclass)
In-Reply-To: <E1tVNW3-000RZY-VT@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox