diff options
| author | Noah Misch | 2025-05-05 11:52:04 +0000 |
|---|---|---|
| committer | Noah Misch | 2025-05-05 11:52:04 +0000 |
| commit | 627acc3caa74caa736b2c5587e944d2ea510ea67 (patch) | |
| tree | 7aed8aec94c841de34fad669bd8b4376ff15c1a3 /src/include/mb | |
| parent | 5be213caaa1a9a65dfdbbf400b6a53b5e743b8d1 (diff) | |
With GB18030, prevent SIGSEGV from reading past end of allocation.
With GB18030 as source encoding, applications could crash the server via
SQL functions convert() or convert_from(). Applications themselves
could crash after passing unterminated GB18030 input to libpq functions
PQescapeLiteral(), PQescapeIdentifier(), PQescapeStringConn(), or
PQescapeString(). Extension code could crash by passing unterminated
GB18030 input to jsonapi.h functions. All those functions have been
intended to handle untrusted, unterminated input safely.
A crash required allocating the input such that the last byte of the
allocation was the last byte of a virtual memory page. Some malloc()
implementations take measures against that, making the SIGSEGV hard to
reach. Back-patch to v13 (all supported versions).
Author: Noah Misch <noah@leadboat.com>
Author: Andres Freund <andres@anarazel.de>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 13
Security: CVE-2025-4207
Diffstat (limited to 'src/include/mb')
| -rw-r--r-- | src/include/mb/pg_wchar.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/include/mb/pg_wchar.h b/src/include/mb/pg_wchar.h index bfef95baea2..4b4a9974b75 100644 --- a/src/include/mb/pg_wchar.h +++ b/src/include/mb/pg_wchar.h @@ -664,6 +664,8 @@ extern int pg_valid_server_encoding_id(int encoding); */ extern void pg_encoding_set_invalid(int encoding, char *dst); extern int pg_encoding_mblen(int encoding, const char *mbstr); +extern int pg_encoding_mblen_or_incomplete(int encoding, const char *mbstr, + size_t remaining); extern int pg_encoding_mblen_bounded(int encoding, const char *mbstr); extern int pg_encoding_dsplen(int encoding, const char *mbstr); extern int pg_encoding_verifymbchar(int encoding, const char *mbstr, int len); |