diff --git a/doc/src/sgml/release-8.3.sgml b/doc/src/sgml/release-8.3.sgml index 7d9764c9874a84e0542643562d9a4ffec9017003..43db2ad35adabea47edd42b1be65cf5c8c6edfd8 100644 --- a/doc/src/sgml/release-8.3.sgml +++ b/doc/src/sgml/release-8.3.sgml @@ -40,6 +40,19 @@ <itemizedlist> + <listitem> + <para> + Prevent execution of <function>enum_recv</> from SQL (Tom Lane) + </para> + + <para> + The function was misdeclared, allowing a simple SQL command to crash the + server. In principle an attacker might be able to use it to examine the + contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) + for reporting this issue. (CVE-2013-0255) + </para> + </listitem> + <listitem> <para> Fix SQL grammar to allow subscripting or field selection from a diff --git a/doc/src/sgml/release-8.4.sgml b/doc/src/sgml/release-8.4.sgml index 1d601f1c07ead3f611e87c7091090fd51294a05a..03f31e63a84a94123175c49cd3ac3edf772539a3 100644 --- a/doc/src/sgml/release-8.4.sgml +++ b/doc/src/sgml/release-8.4.sgml @@ -34,6 +34,19 @@ <itemizedlist> + <listitem> + <para> + Prevent execution of <function>enum_recv</> from SQL (Tom Lane) + </para> + + <para> + The function was misdeclared, allowing a simple SQL command to crash the + server. In principle an attacker might be able to use it to examine the + contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) + for reporting this issue. (CVE-2013-0255) + </para> + </listitem> + <listitem> <para> Update minimum recovery point when truncating a relation file (Heikki diff --git a/doc/src/sgml/release-9.0.sgml b/doc/src/sgml/release-9.0.sgml index fc0af4edbc3b5846daa41a3bfb3f7b1d0b64603c..f3340abc7e613c95f18ec23ee0b877349ea15ea9 100644 --- a/doc/src/sgml/release-9.0.sgml +++ b/doc/src/sgml/release-9.0.sgml @@ -34,6 +34,19 @@ <itemizedlist> + <listitem> + <para> + Prevent execution of <function>enum_recv</> from SQL (Tom Lane) + </para> + + <para> + The function was misdeclared, allowing a simple SQL command to crash the + server. In principle an attacker might be able to use it to examine the + contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) + for reporting this issue. (CVE-2013-0255) + </para> + </listitem> + <listitem> <para> Fix multiple problems in detection of when a consistent database diff --git a/doc/src/sgml/release-9.1.sgml b/doc/src/sgml/release-9.1.sgml index 897b584247a2cbc1449e6d87e79cb627e2e53115..172b125e2228b2650464cc654b852686e0c098e4 100644 --- a/doc/src/sgml/release-9.1.sgml +++ b/doc/src/sgml/release-9.1.sgml @@ -34,6 +34,19 @@ <itemizedlist> + <listitem> + <para> + Prevent execution of <function>enum_recv</> from SQL (Tom Lane) + </para> + + <para> + The function was misdeclared, allowing a simple SQL command to crash the + server. In principle an attacker might be able to use it to examine the + contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) + for reporting this issue. (CVE-2013-0255) + </para> + </listitem> + <listitem> <para> Fix multiple problems in detection of when a consistent database diff --git a/doc/src/sgml/release-9.2.sgml b/doc/src/sgml/release-9.2.sgml index d70ddd66e4a7d7dda4eccfb2c137a9e8f97ab902..61bb925dca425d062142bdadcfc711af1547e8c3 100644 --- a/doc/src/sgml/release-9.2.sgml +++ b/doc/src/sgml/release-9.2.sgml @@ -34,6 +34,19 @@ <itemizedlist> + <listitem> + <para> + Prevent execution of <function>enum_recv</> from SQL (Tom Lane) + </para> + + <para> + The function was misdeclared, allowing a simple SQL command to crash the + server. In principle an attacker might be able to use it to examine the + contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) + for reporting this issue. (CVE-2013-0255) + </para> + </listitem> + <listitem> <para> Fix multiple problems in detection of when a consistent database diff --git a/src/backend/utils/adt/enum.c b/src/backend/utils/adt/enum.c index 01a726be447c56dc670e3a3e86821cc2905e355e..1eb8ccfaee56d88d5be9de4d3dfeb3d2c4ed880d 100644 --- a/src/backend/utils/adt/enum.c +++ b/src/backend/utils/adt/enum.c @@ -18,6 +18,7 @@ #include "access/htup_details.h" #include "catalog/indexing.h" #include "catalog/pg_enum.h" +#include "catalog/pg_type.h" #include "libpq/pqformat.h" #include "utils/array.h" #include "utils/builtins.h" @@ -104,6 +105,10 @@ enum_recv(PG_FUNCTION_ARGS) char *name; int nbytes; + /* guard against pre-9.3 misdeclaration of enum_recv */ + if (get_fn_expr_argtype(fcinfo->flinfo, 0) == CSTRINGOID) + elog(ERROR, "invalid argument for enum_recv"); + name = pq_getmsgtext(buf, buf->len - buf->cursor, &nbytes); /* must check length to prevent Assert failure within SearchSysCache */