From b4b06931ed22e9a38442b16676aaf16ace92bf8d Mon Sep 17 00:00:00 2001
From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Tue, 29 Mar 2016 11:54:58 -0400
Subject: [PATCH] Avoid possibly-unsafe use of Windows' FormatMessage()
function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
---
src/backend/libpq/auth.c | 4 +++-
src/backend/port/win32/socket.c | 4 +++-
src/interfaces/libpq/fe-auth.c | 4 +++-
src/port/dirmod.c | 8 ++++++--
4 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index bc3bd5f3278..51d167fdfc0 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1222,7 +1222,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
{
char sysmsg[256];
- if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+ if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+ FORMAT_MESSAGE_FROM_SYSTEM,
+ NULL, r, 0,
sysmsg, sizeof(sysmsg), NULL) == 0)
ereport(severity,
(errmsg_internal("%s", errmsg),
diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c
index 2e9187f0ca8..64212c73707 100644
--- a/src/backend/port/win32/socket.c
+++ b/src/backend/port/win32/socket.c
@@ -657,7 +657,9 @@ pgwin32_socket_strerror(int err)
}
ZeroMemory(&wserrbuf, sizeof(wserrbuf));
- if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE,
+ if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+ FORMAT_MESSAGE_FROM_SYSTEM |
+ FORMAT_MESSAGE_FROM_HMODULE,
handleDLL,
err,
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index 57861eef799..67dd24a0b1d 100644
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -480,7 +480,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
{
char sysmsg[256];
- if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+ if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+ FORMAT_MESSAGE_FROM_SYSTEM,
+ NULL, r, 0,
sysmsg, sizeof(sysmsg), NULL) == 0)
printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x",
mprefix, (unsigned int) r);
diff --git a/src/port/dirmod.c b/src/port/dirmod.c
index 80932ed966d..0ba0b2a11fd 100644
--- a/src/port/dirmod.c
+++ b/src/port/dirmod.c
@@ -281,7 +281,9 @@ pgsymlink(const char *oldpath, const char *newpath)
LPSTR msg;
errno = 0;
- FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+ FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+ FORMAT_MESSAGE_IGNORE_INSERTS |
+ FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(),
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
(LPSTR) &msg, 0, NULL);
@@ -356,7 +358,9 @@ pgreadlink(const char *path, char *buf, size_t size)
LPSTR msg;
errno = 0;
- FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+ FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+ FORMAT_MESSAGE_IGNORE_INSERTS |
+ FORMAT_MESSAGE_FROM_SYSTEM,
NULL, GetLastError(),
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
(LPSTR) &msg, 0, NULL);
--
GitLab