Skip to content

Commit 45bf240

Browse files
tglsfdctglsfdc
committed
Prevent potential overruns of fixed-size buffers.
Coverity identified a number of places in which it couldn't prove that a string being copied into a fixed-size buffer would fit. We believe that most, perhaps all of these are in fact safe, or are copying data that is coming from a trusted source so that any overrun is not really a security issue. Nonetheless it seems prudent to forestall any risk by using strlcpy() and similar functions. Fixes by Peter Eisentraut and Jozef Mlich based on Coverity reports. In addition, fix a potential null-pointer-dereference crash in contrib/chkpass. The crypt(3) function is defined to return NULL on failure, but chkpass.c didn't check for that before using the result. The main practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., "FIPS mode"). This ideally should've been a separate commit, but since it touches code adjacent to one of the buffer overrun changes, I included it in this commit to avoid last-minute merge issues. This issue was reported by Honza Horak. Security: CVE-2014-0065 for buffer overruns, CVE-2014-0066 for crypt()
1 parent 2c3203e commit 45bf240

File tree

12 files changed

+46
-22
lines changed

12 files changed

+46
-22
lines changed

‎contrib/chkpass/chkpass.c

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ chkpass_in(PG_FUNCTION_ARGS)
7070
char *str = PG_GETARG_CSTRING(0);
7171
chkpass *result;
7272
char mysalt[4];
73+
char *crypt_output;
7374
static char salt_chars[] =
7475
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
7576

@@ -92,7 +93,15 @@ chkpass_in(PG_FUNCTION_ARGS)
9293
mysalt[1] = salt_chars[random() & 0x3f];
9394
mysalt[2] = 0; /* technically the terminator is not necessary
9495
* but I like to play safe */
95-
strcpy(result->password, crypt(str, mysalt));
96+
97+
crypt_output = crypt(str, mysalt);
98+
if (crypt_output == NULL)
99+
ereport(ERROR,
100+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
101+
errmsg("crypt() failed")));
102+
103+
strlcpy(result->password, crypt_output, sizeof(result->password));
104+
96105
PG_RETURN_POINTER(result);
97106
}
98107

@@ -141,9 +150,16 @@ chkpass_eq(PG_FUNCTION_ARGS)
141150
chkpass *a1 = (chkpass *) PG_GETARG_POINTER(0);
142151
text *a2 = PG_GETARG_TEXT_PP(1);
143152
char str[9];
153+
char *crypt_output;
144154

145155
text_to_cstring_buffer(a2, str, sizeof(str));
146-
PG_RETURN_BOOL(strcmp(a1->password, crypt(str, a1->password)) == 0);
156+
crypt_output = crypt(str, a1->password);
157+
if (crypt_output == NULL)
158+
ereport(ERROR,
159+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
160+
errmsg("crypt() failed")));
161+
162+
PG_RETURN_BOOL(strcmp(a1->password, crypt_output) == 0);
147163
}
148164

149165
PG_FUNCTION_INFO_V1(chkpass_ne);
@@ -153,7 +169,14 @@ chkpass_ne(PG_FUNCTION_ARGS)
153169
chkpass *a1 = (chkpass *) PG_GETARG_POINTER(0);
154170
text *a2 = PG_GETARG_TEXT_PP(1);
155171
char str[9];
172+
char *crypt_output;
156173

157174
text_to_cstring_buffer(a2, str, sizeof(str));
158-
PG_RETURN_BOOL(strcmp(a1->password, crypt(str, a1->password)) != 0);
175+
crypt_output = crypt(str, a1->password);
176+
if (crypt_output == NULL)
177+
ereport(ERROR,
178+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
179+
errmsg("crypt() failed")));
180+
181+
PG_RETURN_BOOL(strcmp(a1->password, crypt_output) != 0);
159182
}

‎contrib/pg_standby/pg_standby.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -337,7 +337,7 @@ SetWALFileNameForCleanup(void)
337337
if (strcmp(restartWALFileName, nextWALFileName) > 0)
338338
return false;
339339

340-
strcpy(exclusiveCleanupFileName, restartWALFileName);
340+
strlcpy(exclusiveCleanupFileName, restartWALFileName, sizeof(exclusiveCleanupFileName));
341341
return true;
342342
}
343343

‎src/backend/access/transam/xlog.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5860,7 +5860,7 @@ StartupXLOG(void)
58605860
* see them
58615861
*/
58625862
XLogCtl->RecoveryTargetTLI = recoveryTargetTLI;
5863-
strncpy(XLogCtl->archiveCleanupCommand,
5863+
strlcpy(XLogCtl->archiveCleanupCommand,
58645864
archiveCleanupCommand ? archiveCleanupCommand : "",
58655865
sizeof(XLogCtl->archiveCleanupCommand));
58665866

‎src/backend/tsearch/spell.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ NIAddSpell(IspellDict *Conf, const char *word, const char *flag)
181181
}
182182
Conf->Spell[Conf->nspell] = (SPELL *) tmpalloc(SPELLHDRSZ + strlen(word) + 1);
183183
strcpy(Conf->Spell[Conf->nspell]->word, word);
184-
strncpy(Conf->Spell[Conf->nspell]->p.flag, flag, MAXFLAGLEN);
184+
strlcpy(Conf->Spell[Conf->nspell]->p.flag, flag, MAXFLAGLEN);
185185
Conf->nspell++;
186186
}
187187

‎src/backend/utils/adt/datetime.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,10 @@ char *days[] = {"Sunday", "Monday", "Tuesday", "Wednesday",
8989
* Note that this table must be strictly alphabetically ordered to allow an
9090
* O(ln(N)) search algorithm to be used.
9191
*
92-
* The text field is NOT guaranteed to be NULL-terminated.
92+
* The token field is NOT guaranteed to be NULL-terminated.
9393
*
94-
* To keep this table reasonably small, we divide the lexval for TZ and DTZ
95-
* entries by 15 (so they are on 15 minute boundaries) and truncate the text
94+
* To keep this table reasonably small, we divide the value for TZ and DTZ
95+
* entries by 15 (so they are on 15 minute boundaries) and truncate the token
9696
* field at TOKMAXLEN characters.
9797
* Formerly, we divided by 10 rather than 15 but there are a few time zones
9898
* which are 30 or 45 minutes away from an even hour, most are on an hour
@@ -107,7 +107,7 @@ static datetkn *timezonetktbl = NULL;
107107
static int sztimezonetktbl = 0;
108108

109109
static const datetkn datetktbl[] = {
110-
/* text, token, lexval */
110+
/* token, type, value */
111111
{EARLY, RESERV, DTK_EARLY}, /* "-infinity" reserved for "early time" */
112112
{DA_D, ADBC, AD}, /* "ad" for years > 0 */
113113
{"allballs", RESERV, DTK_ZULU}, /* 00:00:00 */
@@ -187,7 +187,7 @@ static const datetkn datetktbl[] = {
187187
static int szdatetktbl = sizeof datetktbl / sizeof datetktbl[0];
188188

189189
static datetkn deltatktbl[] = {
190-
/* text, token, lexval */
190+
/* token, type, value */
191191
{"@", IGNORE_DTF, 0}, /* postgres relative prefix */
192192
{DAGO, AGO, 0}, /* "ago" indicates negative time offset */
193193
{"c", UNITS, DTK_CENTURY}, /* "century" relative */
@@ -4152,6 +4152,7 @@ InstallTimeZoneAbbrevs(tzEntry *abbrevs, int n)
41524152
n * sizeof(datetkn));
41534153
for (i = 0; i < n; i++)
41544154
{
4155+
/* do NOT use strlcpy here; token field need not be null-terminated */
41554156
strncpy(newtbl[i].token, abbrevs[i].abbrev, TOKMAXLEN);
41564157
newtbl[i].type = abbrevs[i].is_dst ? DTZ : TZ;
41574158
TOVAL(&newtbl[i], abbrevs[i].offset / 60);

‎src/bin/initdb/initdb.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3130,7 +3130,7 @@ main(int argc, char *argv[])
31303130
fprintf(stderr, "%s", authwarning);
31313131

31323132
/* Get directory specification used to start this executable */
3133-
strcpy(bin_dir, argv[0]);
3133+
strlcpy(bin_dir, argv[0], sizeof(bin_dir));
31343134
get_parent_directory(bin_dir);
31353135

31363136
printf(_("\nSuccess. You can now start the database server using:\n\n"

‎src/interfaces/ecpg/preproc/pgc.l

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1312,7 +1312,7 @@ parse_include(void)
13121312
yytext[i] = '\0';
13131313
memmove(yytext, yytext+1, strlen(yytext));
13141314

1315-
strncpy(inc_file, yytext, sizeof(inc_file));
1315+
strlcpy(inc_file, yytext, sizeof(inc_file));
13161316
yyin = fopen(inc_file, "r");
13171317
if (!yyin)
13181318
{

‎src/interfaces/libpq/fe-protocol2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,7 @@ pqParseInput2(PGconn *conn)
440440
if (!conn->result)
441441
return;
442442
}
443-
strncpy(conn->result->cmdStatus, conn->workBuffer.data,
443+
strlcpy(conn->result->cmdStatus, conn->workBuffer.data,
444444
CMDSTATUS_LEN);
445445
checkXactStatus(conn, conn->workBuffer.data);
446446
conn->asyncStatus = PGASYNC_READY;

‎src/interfaces/libpq/fe-protocol3.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ pqParseInput3(PGconn *conn)
206206
if (!conn->result)
207207
return;
208208
}
209-
strncpy(conn->result->cmdStatus, conn->workBuffer.data,
209+
strlcpy(conn->result->cmdStatus, conn->workBuffer.data,
210210
CMDSTATUS_LEN);
211211
conn->asyncStatus = PGASYNC_READY;
212212
break;

‎src/port/exec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ validate_exec(const char *path)
6666
if (strlen(path) >= strlen(".exe") &&
6767
pg_strcasecmp(path + strlen(path) - strlen(".exe"), ".exe") != 0)
6868
{
69-
strcpy(path_exe, path);
69+
strlcpy(path_exe, path, sizeof(path_exe) - 4);
7070
strcat(path_exe, ".exe");
7171
path = path_exe;
7272
}
@@ -275,7 +275,7 @@ resolve_symlinks(char *path)
275275
}
276276

277277
/* must copy final component out of 'path' temporarily */
278-
strcpy(link_buf, fname);
278+
strlcpy(link_buf, fname, sizeof(link_buf));
279279

280280
if (!getcwd(path, MAXPGPATH))
281281
{

‎src/test/regress/pg_regress.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,7 +1237,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12371237
*/
12381238
platform_expectfile = get_expectfile(testname, resultsfile);
12391239

1240-
strcpy(expectfile, default_expectfile);
1240+
strlcpy(expectfile, default_expectfile, sizeof(expectfile));
12411241
if (platform_expectfile)
12421242
{
12431243
/*
@@ -1292,7 +1292,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
12921292
{
12931293
/* This diff was a better match than the last one */
12941294
best_line_count = l;
1295-
strcpy(best_expect_file, alt_expectfile);
1295+
strlcpy(best_expect_file, alt_expectfile, sizeof(best_expect_file));
12961296
}
12971297
free(alt_expectfile);
12981298
}
@@ -1320,7 +1320,7 @@ results_differ(const char *testname, const char *resultsfile, const char *defaul
13201320
{
13211321
/* This diff was a better match than the last one */
13221322
best_line_count = l;
1323-
strcpy(best_expect_file, default_expectfile);
1323+
strlcpy(best_expect_file, default_expectfile, sizeof(best_expect_file));
13241324
}
13251325
}
13261326

‎src/timezone/pgtz.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ pg_open_tzfile(const char *name, char *canonname)
9494
* Loop to split the given name into directory levels; for each level,
9595
* search using scan_directory_ci().
9696
*/
97-
strcpy(fullname, pg_TZDIR());
97+
strlcpy(fullname, pg_TZDIR(), sizeof(fullname));
9898
orignamelen = fullnamelen = strlen(fullname);
9999
fname = name;
100100
for (;;)
@@ -428,7 +428,7 @@ identify_system_timezone(void)
428428
}
429429

430430
/* Search for the best-matching timezone file */
431-
strcpy(tmptzdir, pg_TZDIR());
431+
strlcpy(tmptzdir, pg_TZDIR(), sizeof(tmptzdir));
432432
bestscore = -1;
433433
resultbuf[0] = '\0';
434434
scan_available_timezones(tmptzdir, tmptzdir + strlen(tmptzdir) + 1,

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy