Fix bug that allowed any logged-in user to SET ROLE to any other database user

id (CVE-2006-0553).  Also fix related bug in SET SESSION AUTHORIZATION that
allows unprivileged users to crash the server, if it has been compiled with
Asserts enabled.  The escalation-of-privilege risk exists only in 8.1.0-8.1.2.
However, the Assert-crash risk exists in all releases back to 7.3.
Thanks to Akio Ishida for reporting this problem.

diff --git a/src/backend/commands/variable.c b/src/backend/commands/variable.c
index 38a10bd605b59bc130e24db1ea0dbab2ad1e93be..6d36e5ce1acb6cacfef4f2c209b06dbd3602b2f8 100644 (file)
--- a/src/backend/commands/variable.c
+++ b/src/backend/commands/variable.c
@@ -9,7 +9,7 @@
  *
  *
  * IDENTIFICATION
- *   $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.115 2005/11/22 18:17:10 momjian Exp $
+ *   $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.116 2006/02/12 22:32:42 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -586,7 +586,9 @@ assign_client_encoding(const char *value, bool doit, GucSource source)
  * by the numeric oid, followed by a comma, followed by the role name.
  * This cannot be confused with a plain role name because of the NAMEDATALEN
  * limit on names, so we can tell whether we're being passed an initial
- * role name or a saved/restored value.
+ * role name or a saved/restored value.  (NOTE: we rely on guc.c to have
+ * properly truncated any incoming value, but not to truncate already-stored
+ * values.  See GUC_IS_NAME processing.)
  */
 extern char *session_authorization_string;     /* in guc.c */
 

diff --git a/src/backend/utils/mb/encnames.c b/src/backend/utils/mb/encnames.c
index 0c5eaec66cc5399b2eed3fcaca1c01914afb95ba..45427768132e52d4b52c0475dac2081135c5835c 100644 (file)
--- a/src/backend/utils/mb/encnames.c
+++ b/src/backend/utils/mb/encnames.c
@@ -2,7 +2,7 @@
  * Encoding names and routines for work with it. All
  * in this file is shared bedween FE and BE.
  *
- * $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.27 2006/01/11 08:43:12 neilc Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.28 2006/02/12 22:32:42 tgl Exp $
  */
 #ifdef FRONTEND
 #include "postgres_fe.h"
@@ -449,7 +449,7 @@ pg_char_to_encname_struct(const char *name)
    if (name == NULL || *name == '\0')
        return NULL;
 
-   if (strlen(name) > NAMEDATALEN)
+   if (strlen(name) >= NAMEDATALEN)
    {
 #ifdef FRONTEND
        fprintf(stderr, "encoding name too long\n");

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 6ff6382a482c93ac903771e9b75ee01be638993f..61933fda404a4918acfb4b81008711af259f9058 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -10,7 +10,7 @@
  * Written by Peter Eisentraut <peter_e@gmx.net>.
  *
  * IDENTIFICATION
- *   $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.310 2006/02/04 12:50:47 petere Exp $
+ *   $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.311 2006/02/12 22:32:42 tgl Exp $
  *
  *--------------------------------------------------------------------
  */
@@ -48,6 +48,7 @@
 #include "optimizer/planmain.h"
 #include "parser/parse_expr.h"
 #include "parser/parse_relation.h"
+#include "parser/scansup.h"
 #include "postmaster/autovacuum.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/syslogger.h"
@@ -1707,7 +1708,7 @@ static struct config_string ConfigureNamesString[] =
        {"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE,
            gettext_noop("Sets the client's character set encoding."),
            NULL,
-           GUC_REPORT
+           GUC_IS_NAME | GUC_REPORT
        },
        &client_encoding_string,
        "SQL_ASCII", assign_client_encoding, NULL
@@ -1787,7 +1788,8 @@ static struct config_string ConfigureNamesString[] =
    {
        {"default_tablespace", PGC_USERSET, CLIENT_CONN_STATEMENT,
            gettext_noop("Sets the default tablespace to create tables and indexes in."),
-           gettext_noop("An empty string selects the database's default tablespace.")
+           gettext_noop("An empty string selects the database's default tablespace."),
+           GUC_IS_NAME
        },
        &default_tablespace,
        "", assign_default_tablespace, NULL
@@ -1945,7 +1947,7 @@ static struct config_string ConfigureNamesString[] =
        {"server_encoding", PGC_INTERNAL, CLIENT_CONN_LOCALE,
            gettext_noop("Sets the server (database) character set encoding."),
            NULL,
-           GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+           GUC_IS_NAME | GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
        },
        &server_encoding_string,
        "SQL_ASCII", NULL, NULL
@@ -1967,7 +1969,7 @@ static struct config_string ConfigureNamesString[] =
        {"role", PGC_USERSET, UNGROUPED,
            gettext_noop("Sets the current role."),
            NULL,
-           GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+           GUC_IS_NAME | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
        },
        &role_string,
        "none", assign_role, show_role
@@ -1978,7 +1980,7 @@ static struct config_string ConfigureNamesString[] =
        {"session_authorization", PGC_USERSET, UNGROUPED,
            gettext_noop("Sets the session user name."),
            NULL,
-           GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+           GUC_IS_NAME | GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
        },
        &session_authorization_string,
        NULL, assign_session_authorization, show_session_authorization
@@ -3988,6 +3990,12 @@ set_config_option(const char *name, const char *value,
                    newval = guc_strdup(elevel, value);
                    if (newval == NULL)
                        return false;
+                   /*
+                    * The only sort of "parsing" check we need to do is
+                    * apply truncation if GUC_IS_NAME.
+                    */
+                   if (conf->gen.flags & GUC_IS_NAME)
+                       truncate_identifier(newval, strlen(newval), true);
                }
                else if (conf->reset_val)
                {

diff --git a/src/include/utils/guc_tables.h b/src/include/utils/guc_tables.h
index beddf5dd5f0a7c21411e4f3c60fde2d52415559a..c4227ece25643ff335187676f3db3610b03eccc1 100644 (file)
--- a/src/include/utils/guc_tables.h
+++ b/src/include/utils/guc_tables.h
@@ -7,7 +7,7 @@
  *
  * Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
  *
- *   $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.20 2005/07/14 05:13:44 tgl Exp $
+ *   $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.21 2006/02/12 22:32:43 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -126,6 +126,7 @@ struct config_generic
 #define GUC_DISALLOW_IN_FILE   0x0040  /* can't set in postgresql.conf */
 #define GUC_CUSTOM_PLACEHOLDER 0x0080  /* placeholder for custom variable */
 #define GUC_SUPERUSER_ONLY     0x0100  /* show only to superusers */
+#define GUC_IS_NAME                0x0200  /* limit string to NAMEDATALEN-1 */
 
 /* bit values in status field */
 #define GUC_HAVE_TENTATIVE 0x0001      /* tentative value is defined */