From: Jacob Champion <jchampion@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: libpq: Prevent some overflows of int/size_t
Date: Mon, 10 Nov 2025 14:24:49 +0000
Message-ID: <E1vISp7-005veB-2H@gemulon.postgresql.org> (raw)
libpq: Prevent some overflows of int/size_t
Several functions could overflow their size calculations, when presented
with very large inputs from remote and/or untrusted locations, and then
allocate buffers that were too small to hold the intended contents.
Switch from int to size_t where appropriate, and check for overflow
conditions when the inputs could have plausibly originated outside of
the libpq trust boundary. (Overflows from within the trust boundary are
still possible, but these will be fixed separately.) A version of
add_size() is ported from the backend to assist with code that performs
more complicated concatenation.
Reported-by: Aleksey Solovev (Positive Technologies)
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Security: CVE-2025-12818
Backpatch-through: 13
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/600086f471a3bb57ff4953accf1d3f8d2efe0201
Modified Files
--------------
src/interfaces/libpq/fe-connect.c | 17 +++++-
src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------
src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++--
src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++----
src/interfaces/libpq/libpq-int.h | 11 +++-
5 files changed, 224 insertions(+), 33 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: jchampion@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: libpq: Prevent some overflows of int/size_t
In-Reply-To: <E1vISp7-005veB-2H@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox