pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling 6+ messages / 1 participants [nested] [flat]
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/985908df18116b5d2a496b1581c337aab23ea64e Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/a92db3d02dbd77612adc1a0a83d54dfef7dd8345 Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/efdadeb2238f5b5f0f32df2f3e7d277d1faf1c4f Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/111f4dd273c840426d296c3b2ed0c5c67e3f4c37 Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/1f7a05324524f015a4a3a4a3fb921b11f8126051 Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling @ 2025-02-14 23:51 Andres Freund <andres@anarazel.de> 0 siblings, 0 replies; 6+ messages in thread From: Andres Freund @ 2025-02-14 23:51 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix PQescapeLiteral()/PQescapeIdentifier() length handling In 5dc1e42b4fa I fixed bugs in various escape functions, unfortunately as part of that I introduced a new bug in PQescapeLiteral()/PQescapeIdentifier(). The bug is that I made PQescapeInternal() just use strlen(), rather than taking the specified input length into account. That's bad, because it can lead to including input that wasn't intended to be included (in case len is shorter than null termination of the string) and because it can lead to reading invalid memory if the input string is not null terminated. Expand test_escape to this kind of bug: a) for escape functions with length support, append data that should not be escaped and check that it is not b) add valgrind requests to detect access of bytes that should not be touched Author: Tom Lane <tgl@sss.pgh.pa.us> Author: Andres Freund <andres@anarazel.de Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Discussion: https://postgr.es/m/Z64jD3u46gObCo1p@pryzbyj2023 Backpatch: 13 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/22ffbbf24db4e5996abcf376ef1735346d4b6f75 Modified Files -------------- src/interfaces/libpq/fe-exec.c | 4 +- src/test/modules/test_escape/test_escape.c | 78 ++++++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2025-02-14 23:51 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de> 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de> 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de> 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de> 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de> 2025-02-14 23:51 pgsql: Fix PQescapeLiteral()/PQescapeIdentifier() length handling Andres Freund <andres@anarazel.de>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox