Skip to content

Commit 6e05b19

Browse files
anarazelanarazel
committed
Add pg_encoding_set_invalid()
There are cases where we cannot / do not want to error out for invalidly encoded input. In such cases it can be useful to replace e.g. an incomplete multi-byte characters with bytes that will trigger an error when getting validated as part of a larger string. Unfortunately, until now, for some encoding no such sequence existed. For those encodings this commit removes one previously accepted input combination - we consider that to be ok, as the chosen bytes are outside of the valid ranges for the encodings, we just previously failed to detect that. As we cannot add a new field to pg_wchar_table without breaking ABI, this is implemented "in-line" in the newly added function. Author: Noah Misch <noah@leadboat.com> Reviewed-by: Andres Freund <andres@anarazel.de> Backpatch-through: 13 Security: CVE-2025-1094
1 parent ef23624 commit 6e05b19

File tree

5 files changed

+117
-1
lines changed

5 files changed

+117
-1
lines changed

‎src/common/wchar.c

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,25 @@
1616
#include "utils/ascii.h"
1717

1818

19+
/*
20+
* In today's multibyte encodings other than UTF8, this two-byte sequence
21+
* ensures pg_encoding_mblen() == 2 && pg_encoding_verifymbstr() == 0.
22+
*
23+
* For historical reasons, several verifychar implementations opt to reject
24+
* this pair specifically. Byte pair range constraints, in encoding
25+
* originator documentation, always excluded this pair. No core conversion
26+
* could translate it. However, longstanding verifychar implementations
27+
* accepted any non-NUL byte. big5_to_euc_tw and big5_to_mic even translate
28+
* pairs not valid per encoding originator documentation. To avoid tightening
29+
* core or non-core conversions in a security patch, we sought this one pair.
30+
*
31+
* PQescapeString() historically used spaces for BYTE1; many other values
32+
* could suffice for BYTE1.
33+
*/
34+
#define NONUTF8_INVALID_BYTE0 (0x8d)
35+
#define NONUTF8_INVALID_BYTE1 (' ')
36+
37+
1938
/*
2039
* Operations on multi-byte encodings are driven by a table of helper
2140
* functions.
@@ -1526,6 +1545,11 @@ pg_big5_verifychar(const unsigned char *s, int len)
15261545
if (len < l)
15271546
return -1;
15281547

1548+
if (l == 2 &&
1549+
s[0] == NONUTF8_INVALID_BYTE0 &&
1550+
s[1] == NONUTF8_INVALID_BYTE1)
1551+
return -1;
1552+
15291553
while (--l > 0)
15301554
{
15311555
if (*++s == '\0')
@@ -1575,6 +1599,11 @@ pg_gbk_verifychar(const unsigned char *s, int len)
15751599
if (len < l)
15761600
return -1;
15771601

1602+
if (l == 2 &&
1603+
s[0] == NONUTF8_INVALID_BYTE0 &&
1604+
s[1] == NONUTF8_INVALID_BYTE1)
1605+
return -1;
1606+
15781607
while (--l > 0)
15791608
{
15801609
if (*++s == '\0')
@@ -1624,6 +1653,11 @@ pg_uhc_verifychar(const unsigned char *s, int len)
16241653
if (len < l)
16251654
return -1;
16261655

1656+
if (l == 2 &&
1657+
s[0] == NONUTF8_INVALID_BYTE0 &&
1658+
s[1] == NONUTF8_INVALID_BYTE1)
1659+
return -1;
1660+
16271661
while (--l > 0)
16281662
{
16291663
if (*++s == '\0')
@@ -2068,6 +2102,19 @@ pg_utf8_islegal(const unsigned char *source, int length)
20682102
}
20692103

20702104

2105+
/*
2106+
* Fills the provided buffer with two bytes such that:
2107+
* pg_encoding_mblen(dst) == 2 && pg_encoding_verifymbstr(dst) == 0
2108+
*/
2109+
void
2110+
pg_encoding_set_invalid(int encoding, char *dst)
2111+
{
2112+
Assert(pg_encoding_max_length(encoding) > 1);
2113+
2114+
dst[0] = (encoding == PG_UTF8 ? 0xc0 : NONUTF8_INVALID_BYTE0);
2115+
dst[1] = NONUTF8_INVALID_BYTE1;
2116+
}
2117+
20712118
/*
20722119
*-------------------------------------------------------------------
20732120
* encoding info table
@@ -2190,5 +2237,11 @@ pg_encoding_max_length(int encoding)
21902237
{
21912238
Assert(PG_VALID_ENCODING(encoding));
21922239

2193-
return pg_wchar_table[encoding].maxmblen;
2240+
/*
2241+
* Check for the encoding despite the assert, due to some mingw versions
2242+
* otherwise issuing bogus warnings.
2243+
*/
2244+
return PG_VALID_ENCODING(encoding) ?
2245+
pg_wchar_table[encoding].maxmblen :
2246+
pg_wchar_table[PG_SQL_ASCII].maxmblen;
21942247
}

‎src/include/mb/pg_wchar.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,7 @@ extern int pg_valid_server_encoding_id(int encoding);
573573
* (in addition to the ones just above). The constant tables declared
574574
* earlier in this file are also available from libpgcommon.
575575
*/
576+
extern void pg_encoding_set_invalid(int encoding, char *dst);
576577
extern int pg_encoding_mblen(int encoding, const char *mbstr);
577578
extern int pg_encoding_mblen_bounded(int encoding, const char *mbstr);
578579
extern int pg_encoding_dsplen(int encoding, const char *mbstr);

‎src/test/regress/expected/conversion.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,13 @@
55
\getenv libdir PG_LIBDIR
66
\getenv dlsuffix PG_DLSUFFIX
77
\set regresslib :libdir '/regress' :dlsuffix
8+
CREATE FUNCTION test_enc_setup() RETURNS void
9+
AS :'regresslib', 'test_enc_setup'
10+
LANGUAGE C STRICT;
11+
SELECT FROM test_enc_setup();
12+
--
13+
(1 row)
14+
815
CREATE FUNCTION test_enc_conversion(bytea, name, name, bool, validlen OUT int, result OUT bytea)
916
AS :'regresslib', 'test_enc_conversion'
1017
LANGUAGE C STRICT;

‎src/test/regress/regress.c

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1105,6 +1105,56 @@ test_opclass_options_func(PG_FUNCTION_ARGS)
11051105
PG_RETURN_NULL();
11061106
}
11071107

1108+
/* one-time tests for encoding infrastructure */
1109+
PG_FUNCTION_INFO_V1(test_enc_setup);
1110+
Datum
1111+
test_enc_setup(PG_FUNCTION_ARGS)
1112+
{
1113+
/* Test pg_encoding_set_invalid() */
1114+
for (int i = 0; i < _PG_LAST_ENCODING_; i++)
1115+
{
1116+
char buf[2],
1117+
bigbuf[16];
1118+
int len,
1119+
mblen,
1120+
valid;
1121+
1122+
if (pg_encoding_max_length(i) == 1)
1123+
continue;
1124+
pg_encoding_set_invalid(i, buf);
1125+
len = strnlen(buf, 2);
1126+
if (len != 2)
1127+
elog(WARNING,
1128+
"official invalid string for encoding \"%s\" has length %d",
1129+
pg_enc2name_tbl[i].name, len);
1130+
mblen = pg_encoding_mblen(i, buf);
1131+
if (mblen != 2)
1132+
elog(WARNING,
1133+
"official invalid string for encoding \"%s\" has mblen %d",
1134+
pg_enc2name_tbl[i].name, mblen);
1135+
valid = pg_encoding_verifymbstr(i, buf, len);
1136+
if (valid != 0)
1137+
elog(WARNING,
1138+
"official invalid string for encoding \"%s\" has valid prefix of length %d",
1139+
pg_enc2name_tbl[i].name, valid);
1140+
valid = pg_encoding_verifymbstr(i, buf, 1);
1141+
if (valid != 0)
1142+
elog(WARNING,
1143+
"first byte of official invalid string for encoding \"%s\" has valid prefix of length %d",
1144+
pg_enc2name_tbl[i].name, valid);
1145+
memset(bigbuf, ' ', sizeof(bigbuf));
1146+
bigbuf[0] = buf[0];
1147+
bigbuf[1] = buf[1];
1148+
valid = pg_encoding_verifymbstr(i, bigbuf, sizeof(bigbuf));
1149+
if (valid != 0)
1150+
elog(WARNING,
1151+
"trailing data changed official invalid string for encoding \"%s\" to have valid prefix of length %d",
1152+
pg_enc2name_tbl[i].name, valid);
1153+
}
1154+
1155+
PG_RETURN_VOID();
1156+
}
1157+
11081158
/*
11091159
* Call an encoding conversion or verification function.
11101160
*

‎src/test/regress/sql/conversion.sql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
\set regresslib :libdir '/regress' :dlsuffix
1010

11+
CREATE FUNCTION test_enc_setup() RETURNS void
12+
AS :'regresslib', 'test_enc_setup'
13+
LANGUAGE C STRICT;
14+
SELECT FROM test_enc_setup();
15+
1116
CREATE FUNCTION test_enc_conversion(bytea, name, name, bool, validlen OUT int, result OUT bytea)
1217
AS :'regresslib', 'test_enc_conversion'
1318
LANGUAGE C STRICT;

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy