From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: With GB18030, prevent SIGSEGV from reading past end of allocatio
Date: Mon, 05 May 2025 11:52:35 +0000
Message-ID: <E1uBuN8-000FV8-2a@gemulon.postgresql.org> (raw)
With GB18030, prevent SIGSEGV from reading past end of allocation.
With GB18030 as source encoding, applications could crash the server via
SQL functions convert() or convert_from(). Applications themselves
could crash after passing unterminated GB18030 input to libpq functions
PQescapeLiteral(), PQescapeIdentifier(), PQescapeStringConn(), or
PQescapeString(). Extension code could crash by passing unterminated
GB18030 input to jsonapi.h functions. All those functions have been
intended to handle untrusted, unterminated input safely.
A crash required allocating the input such that the last byte of the
allocation was the last byte of a virtual memory page. Some malloc()
implementations take measures against that, making the SIGSEGV hard to
reach. Back-patch to v13 (all supported versions).
Author: Noah Misch <noah@leadboat.com>
Author: Andres Freund <andres@anarazel.de>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 13
Security: CVE-2025-4207
Branch
------
REL_13_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/cbadeaca9271a1bade8ef9790bae09dc92e0ed30
Modified Files
--------------
src/backend/utils/mb/mbutils.c | 18 ++++--
src/common/jsonapi.c | 7 ++-
src/common/wchar.c | 51 +++++++++++++--
src/include/mb/pg_wchar.h | 2 +
src/interfaces/libpq/fe-exec.c | 6 +-
src/interfaces/libpq/fe-misc.c | 5 +-
src/test/modules/test_escape/test_escape.c | 99 ++++++++++++++++++++++++++++++
7 files changed, 171 insertions(+), 17 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: With GB18030, prevent SIGSEGV from reading past end of allocatio
In-Reply-To: <E1uBuN8-000FV8-2a@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox