hcq/postgresql
1
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2026-02-22 14:27:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Protect against small overread in SASLprep validation

Browse Source 
(This is a cherry-pick of 390b3cbbb, which I hadn't realized wasn't
backpatched. It was originally reported to security@ and determined not
to be a vulnerability; thanks to Stanislav Osipov for noticing the
omission in the back branches.)

In case of torn UTF8 in the input data we might end up going
past the end of the string since we don't account for length.
While validation won't be performed on a sequence with a NULL
byte it's better to avoid going past the end to beging with.
Fix by taking the length into consideration.

Reported-by: Stanislav Osipov <stasos24@gmail.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Discussion: https://postgr.es/m/CAOYmi+mTnmM172g=_+Yvc47hzzeAsYPy2C4UBY3HK9p-AXNV0g@mail.gmail.com
Backpatch-through: 14
This commit is contained in:
Jacob Champion
2026-02-06 11:08:59 -08:00
parent 977a17a3eb
commit 46aaec4c0e
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/common/saslprep.c
View File

@ -1009,15 +1009,17 @@ pg_utf8_string_len(const char *source)
const unsigned char *p = (const unsigned char *) source;
int l;
int num_chars = 0;
size_t len = strlen(source);
while (*p)
while (len)
{
l = pg_utf_mblen(p);
if (!pg_utf8_islegal(p, l))
if (len < l || !pg_utf8_islegal(p, l))
return -1;
p += l;
len -= l;
num_chars++;
}