-
- Downloads
Predict integer overflow to avoid buffer overruns.
Several functions, mostly type input functions, calculated an allocation size such that the calculation wrapped to a small positive value when arguments implied a sufficiently-large requirement. Writes past the end of the inadvertent small allocation followed shortly thereafter. Coverity identified the path_in() vulnerability; code inspection led to the rest. In passing, add check_stack_depth() to prevent stack overflow in related functions. Back-patch to 8.4 (all supported versions). The non-comment hstore changes touch code that did not exist in 8.4, so that part stops at 9.0. Noah Misch and Heikki Linnakangas, reviewed by Tom Lane. Security: CVE-2014-0064
Showing
- contrib/hstore/hstore.h 12 additions, 3 deletionscontrib/hstore/hstore.h
- contrib/hstore/hstore_io.c 21 additions, 0 deletionscontrib/hstore/hstore_io.c
- contrib/hstore/hstore_op.c 15 additions, 0 deletionscontrib/hstore/hstore_op.c
- contrib/intarray/_int.h 2 additions, 0 deletionscontrib/intarray/_int.h
- contrib/intarray/_int_bool.c 9 additions, 0 deletionscontrib/intarray/_int_bool.c
- contrib/ltree/ltree.h 3 additions, 0 deletionscontrib/ltree/ltree.h
- contrib/ltree/ltree_io.c 11 additions, 0 deletionscontrib/ltree/ltree_io.c
- contrib/ltree/ltxtquery_io.c 12 additions, 1 deletioncontrib/ltree/ltxtquery_io.c
- src/backend/utils/adt/geo_ops.c 28 additions, 2 deletionssrc/backend/utils/adt/geo_ops.c
- src/backend/utils/adt/tsquery.c 6 additions, 1 deletionsrc/backend/utils/adt/tsquery.c
- src/backend/utils/adt/tsquery_util.c 5 additions, 0 deletionssrc/backend/utils/adt/tsquery_util.c
- src/backend/utils/adt/txid.c 5 additions, 10 deletionssrc/backend/utils/adt/txid.c
- src/backend/utils/adt/varbit.c 30 additions, 2 deletionssrc/backend/utils/adt/varbit.c
- src/include/tsearch/ts_type.h 3 additions, 0 deletionssrc/include/tsearch/ts_type.h
- src/include/utils/varbit.h 7 additions, 0 deletionssrc/include/utils/varbit.h
Loading
Please register or sign in to comment