public inbox for [email protected]  

help / color / mirror / Atom feed

From: Kris Jurka <[email protected]>
To: Tom Lane <[email protected]>
Cc: Thomas Hallgren <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Alvaro Herrera <[email protected]>
Subject: Re: [Pljava-dev] Re: Should creating a new base type require superuser status?
Date: Wed, 18 Feb 2009 00:43:38 -0500 (EST)
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>



On Sat, 2 Aug 2008, Tom Lane wrote:

> So what exactly does happen when the user deliberately specifies wrong
> typlen/typbyval/typalign info when creating a type based on PL/Java
> functions?

I have reviewed pljava's handling of misrepresented alignment, length, and 
by value parameters

1) Alignment: pljava reads and writes data a byte at a time, so all types 
effectively have char alignment.  Reading an integer will read 
four bytes out of memory and then put those together.  Therefore the 
alignment cannot be misspecified.

2) Length: For fixed length types, pljava correctly detects trying to 
read or write too much data and not supplying enough data on write. 
Pljava does not correctly handle variable length types.  It should be 
setting and reading the length header itself rather than leaving that up 
to the user, but it is not.

3) By value: pljava does not correctly handle passed by value types 
correctly, allowing access to random memory.

So yes, pljava has a security problem, but I still object to the statement 
that no PL can do this securely.  I will work on fixing pljava, but I 
request the change for superuser requirement for type creation be 
reverted.  The fact that no PL currently does it correctly is not a reason 
to prohibit a PL from doing it correctly.

Kris Jurka

view thread (21+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: [Pljava-dev] Re: Should creating a new base type require superuser status?
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox