pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: libpq: Prevent some overflows of int/size_t 7+ messages / 1 participants [nested] [flat]
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/600086f471a3bb57ff4953accf1d3f8d2efe0201 Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7eb8fcad860e9a0548191dab7a87a5bead5f8e91 Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f5999f01815969dfe8df33bac9c0f1aa38dd6cd5 Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/585fd9b3c617db9adeb717c3def6f64aad2135cc Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/91421565febbf99c1ea2341070878dc50ab0afef Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/96d2c7e96e8bb6563b0b6e0d8d02162ed67ff12e Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: libpq: Prevent some overflows of int/size_t @ 2025-11-10 14:24 Jacob Champion <jchampion@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Jacob Champion @ 2025-11-10 14:24 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to size_t where appropriate, and check for overflow conditions when the inputs could have plausibly originated outside of the libpq trust boundary. (Overflows from within the trust boundary are still possible, but these will be fixed separately.) A version of add_size() is ported from the backend to assist with code that performs more complicated concatenation. Reported-by: Aleksey Solovev (Positive Technologies) Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Security: CVE-2025-12818 Backpatch-through: 13 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d6f0c0d6d6d3f14177848e4a00df988fa2f0a09a Modified Files -------------- src/interfaces/libpq/fe-connect.c | 17 +++++- src/interfaces/libpq/fe-exec.c | 101 ++++++++++++++++++++++++++++++------ src/interfaces/libpq/fe-print.c | 61 ++++++++++++++++++++-- src/interfaces/libpq/fe-protocol3.c | 67 ++++++++++++++++++++---- src/interfaces/libpq/libpq-int.h | 11 +++- 5 files changed, 224 insertions(+), 33 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2025-11-10 14:24 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org> 2025-11-10 14:24 pgsql: libpq: Prevent some overflows of int/size_t Jacob Champion <jchampion@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox