diff options
| author | Tom Lane | 2016-03-29 15:54:57 +0000 |
|---|---|---|
| committer | Tom Lane | 2016-03-29 15:55:19 +0000 |
| commit | 7abc1571652a924ba4258bda0a26df2de03b790e (patch) | |
| tree | d606955e4a266c6ebf185c2ce87bf0f8f391ffdb /src/backend/libpq | |
| parent | 61d66c44f18c73094a50a2ef97d26cc03e171dc0 (diff) | |
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
Diffstat (limited to 'src/backend/libpq')
| -rw-r--r-- | src/backend/libpq/auth.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 7f1ae8c137a..899da712f7a 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1011,7 +1011,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r) { char sysmsg[256]; - if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0, + if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, + NULL, r, 0, sysmsg, sizeof(sysmsg), NULL) == 0) ereport(severity, (errmsg_internal("%s", errmsg), |