Skip to content

Commit 71627f3

Browse files
tglsfdctglsfdc
committed
Fix CVE-2013-0255 properly.
Revert commit ab0f7b6 (in HEAD only) in favor of the proper solution, which is to declare enum_recv() correctly in the system catalogs. It should be declared to take type "internal" not "cstring". Also improve the type_sanity regression test, which should have caught this typo, so that it actually would. Most of the relevant checks on the signature of type I/O functions should not have been restricted to basetypes/pseudotypes, as they should apply to any type's I/O functions.
1 parent 9728eda commit 71627f3

File tree

5 files changed

+22
-19
lines changed

5 files changed

+22
-19
lines changed

‎src/backend/utils/adt/enum.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
#include "access/htup_details.h"
1919
#include "catalog/indexing.h"
2020
#include "catalog/pg_enum.h"
21-
#include "catalog/pg_type.h"
2221
#include "libpq/pqformat.h"
2322
#include "utils/array.h"
2423
#include "utils/builtins.h"
@@ -105,10 +104,6 @@ enum_recv(PG_FUNCTION_ARGS)
105104
char *name;
106105
int nbytes;
107106

108-
/* guard against pre-9.3 misdeclaration of enum_recv */
109-
if (get_fn_expr_argtype(fcinfo->flinfo, 0) == CSTRINGOID)
110-
elog(ERROR, "invalid argument for enum_recv");
111-
112107
name = pq_getmsgtext(buf, buf->len - buf->cursor, &nbytes);
113108

114109
/* must check length to prevent Assert failure within SearchSysCache */

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 201301231
56+
#define CATALOG_VERSION_NO 201302131
5757

5858
#endif

‎src/include/catalog/pg_proc.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4160,7 +4160,7 @@ DATA(insert OID = 3530 ( enum_range PGNSP PGUID 12 1 0 0 0 f f f f f f s 2 0 22
41604160
DESCR("range between the two given enum values, as an ordered array");
41614161
DATA(insert OID = 3531 ( enum_range PGNSP PGUID 12 1 0 0 0 f f f f f f s 1 0 2277 "3500" _null_ _null_ _null_ _null_ enum_range_all _null_ _null_ _null_ ));
41624162
DESCR("range of the given enum type, as an ordered array");
4163-
DATA(insert OID = 3532 ( enum_recv PGNSP PGUID 12 1 0 0 0 f f f f t f s 2 0 3500 "2275 26" _null_ _null_ _null_ _null_ enum_recv _null_ _null_ _null_ ));
4163+
DATA(insert OID = 3532 ( enum_recv PGNSP PGUID 12 1 0 0 0 f f f f t f s 2 0 3500 "2281 26" _null_ _null_ _null_ _null_ enum_recv _null_ _null_ _null_ ));
41644164
DESCR("I/O");
41654165
DATA(insert OID = 3533 ( enum_send PGNSP PGUID 12 1 0 0 0 f f f f t f s 1 0 17 "3500" _null_ _null_ _null_ _null_ enum_send _null_ _null_ _null_ ));
41664166
DESCR("I/O");

‎src/test/regress/expected/type_sanity.out

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,10 @@ WHERE (p1.typinput = 0 OR p1.typoutput = 0);
117117
-- Check for bogus typinput routines
118118
SELECT p1.oid, p1.typname, p2.oid, p2.proname
119119
FROM pg_type AS p1, pg_proc AS p2
120-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
120+
WHERE p1.typinput = p2.oid AND NOT
121121
((p2.pronargs = 1 AND p2.proargtypes[0] = 'cstring'::regtype) OR
122+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'cstring'::regtype AND
123+
p2.proargtypes[1] = 'oid'::regtype) OR
122124
(p2.pronargs = 3 AND p2.proargtypes[0] = 'cstring'::regtype AND
123125
p2.proargtypes[1] = 'oid'::regtype AND
124126
p2.proargtypes[2] = 'int4'::regtype));
@@ -143,7 +145,7 @@ ORDER BY 1;
143145
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
144146
SELECT p1.oid, p1.typname, p2.oid, p2.proname
145147
FROM pg_type AS p1, pg_proc AS p2
146-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND
148+
WHERE p1.typinput = p2.oid AND
147149
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
148150
(p2.oid = 'array_in'::regproc)
149151
ORDER BY 1;
@@ -184,7 +186,7 @@ ORDER BY 1;
184186

185187
SELECT p1.oid, p1.typname, p2.oid, p2.proname
186188
FROM pg_type AS p1, pg_proc AS p2
187-
WHERE p1.typoutput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
189+
WHERE p1.typoutput = p2.oid AND NOT
188190
(p2.prorettype = 'cstring'::regtype AND NOT p2.proretset);
189191
oid | typname | oid | proname
190192
-----+---------+-----+---------
@@ -213,8 +215,10 @@ WHERE p1.typtype = 'd' AND p1.typoutput IS DISTINCT FROM p2.typoutput;
213215
-- Check for bogus typreceive routines
214216
SELECT p1.oid, p1.typname, p2.oid, p2.proname
215217
FROM pg_type AS p1, pg_proc AS p2
216-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND NOT
218+
WHERE p1.typreceive = p2.oid AND NOT
217219
((p2.pronargs = 1 AND p2.proargtypes[0] = 'internal'::regtype) OR
220+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'internal'::regtype AND
221+
p2.proargtypes[1] = 'oid'::regtype) OR
218222
(p2.pronargs = 3 AND p2.proargtypes[0] = 'internal'::regtype AND
219223
p2.proargtypes[1] = 'oid'::regtype AND
220224
p2.proargtypes[2] = 'int4'::regtype));
@@ -239,7 +243,7 @@ ORDER BY 1;
239243
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
240244
SELECT p1.oid, p1.typname, p2.oid, p2.proname
241245
FROM pg_type AS p1, pg_proc AS p2
242-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND
246+
WHERE p1.typreceive = p2.oid AND
243247
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
244248
(p2.oid = 'array_recv'::regproc)
245249
ORDER BY 1;
@@ -289,7 +293,7 @@ ORDER BY 1;
289293

290294
SELECT p1.oid, p1.typname, p2.oid, p2.proname
291295
FROM pg_type AS p1, pg_proc AS p2
292-
WHERE p1.typsend = p2.oid AND p1.typtype in ('b', 'p') AND NOT
296+
WHERE p1.typsend = p2.oid AND NOT
293297
(p2.prorettype = 'bytea'::regtype AND NOT p2.proretset);
294298
oid | typname | oid | proname
295299
-----+---------+-----+---------

‎src/test/regress/sql/type_sanity.sql

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,10 @@ WHERE (p1.typinput = 0 OR p1.typoutput = 0);
9696

9797
SELECT p1.oid, p1.typname, p2.oid, p2.proname
9898
FROM pg_type AS p1, pg_proc AS p2
99-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
99+
WHERE p1.typinput = p2.oid AND NOT
100100
((p2.pronargs = 1 AND p2.proargtypes[0] = 'cstring'::regtype) OR
101+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'cstring'::regtype AND
102+
p2.proargtypes[1] = 'oid'::regtype) OR
101103
(p2.pronargs = 3 AND p2.proargtypes[0] = 'cstring'::regtype AND
102104
p2.proargtypes[1] = 'oid'::regtype AND
103105
p2.proargtypes[2] = 'int4'::regtype));
@@ -115,7 +117,7 @@ ORDER BY 1;
115117
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
116118
SELECT p1.oid, p1.typname, p2.oid, p2.proname
117119
FROM pg_type AS p1, pg_proc AS p2
118-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND
120+
WHERE p1.typinput = p2.oid AND
119121
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
120122
(p2.oid = 'array_in'::regproc)
121123
ORDER BY 1;
@@ -141,7 +143,7 @@ ORDER BY 1;
141143

142144
SELECT p1.oid, p1.typname, p2.oid, p2.proname
143145
FROM pg_type AS p1, pg_proc AS p2
144-
WHERE p1.typoutput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
146+
WHERE p1.typoutput = p2.oid AND NOT
145147
(p2.prorettype = 'cstring'::regtype AND NOT p2.proretset);
146148

147149
-- Composites, enums, ranges should all use the same output routines
@@ -159,8 +161,10 @@ WHERE p1.typtype = 'd' AND p1.typoutput IS DISTINCT FROM p2.typoutput;
159161

160162
SELECT p1.oid, p1.typname, p2.oid, p2.proname
161163
FROM pg_type AS p1, pg_proc AS p2
162-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND NOT
164+
WHERE p1.typreceive = p2.oid AND NOT
163165
((p2.pronargs = 1 AND p2.proargtypes[0] = 'internal'::regtype) OR
166+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'internal'::regtype AND
167+
p2.proargtypes[1] = 'oid'::regtype) OR
164168
(p2.pronargs = 3 AND p2.proargtypes[0] = 'internal'::regtype AND
165169
p2.proargtypes[1] = 'oid'::regtype AND
166170
p2.proargtypes[2] = 'int4'::regtype));
@@ -178,7 +182,7 @@ ORDER BY 1;
178182
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
179183
SELECT p1.oid, p1.typname, p2.oid, p2.proname
180184
FROM pg_type AS p1, pg_proc AS p2
181-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND
185+
WHERE p1.typreceive = p2.oid AND
182186
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
183187
(p2.oid = 'array_recv'::regproc)
184188
ORDER BY 1;
@@ -210,7 +214,7 @@ ORDER BY 1;
210214

211215
SELECT p1.oid, p1.typname, p2.oid, p2.proname
212216
FROM pg_type AS p1, pg_proc AS p2
213-
WHERE p1.typsend = p2.oid AND p1.typtype in ('b', 'p') AND NOT
217+
WHERE p1.typsend = p2.oid AND NOT
214218
(p2.prorettype = 'bytea'::regtype AND NOT p2.proretset);
215219

216220
-- Composites, enums, ranges should all use the same send routines

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy