Attachment 19739 Details for Bug 55714

[patch] proposed patch from debian

patch.CAN-2004-NNNN.postgresql (text/plain), 5.98 KB, created by Sebastian Krahmer on 2004-05-17 21:01:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-05-17 21:01:48 UTC

Size: 5.98 KB

patch

obsolete

>diff -u postgresql-7.2.1/debian/changelog postgresql-7.2.1/debian/changelog
>--- postgresql-7.2.1/debian/changelog
>+++ postgresql-7.2.1/debian/changelog
>@@ -1,3 +1,18 @@
>+postgresql (7.2.1-2woody5) stable-security; urgency=low
>+
>+  * Fixed buffer overflow in ODBC driver (src/interfaces/odbc/):
>+    added parameter for target buffer size to make_string() to prevent
>+    buffer overflows and corrected all calls to it. This fixes #247306 for
>+    woody (bug was already closed with the upload to sid).
>+
>+    With previous versions it was possible to crash (and possibly exploit) 
>+    e. g. apache if a PHP script connected to a ODBC database with very long
>+    credential strings (DSN, username, password, etc.).
>+
>+    Other parts of postgresql are not affected.
>+
>+ -- Martin Pitt <mpitt@debian.org>  Thu, 13 May 2004 11:00:07 +0200
>+
> postgresql (7.2.1-2woody4) stable-security; urgency=low
> 
>   * Updated config/config.{guess,sub} to the recent woody version (building on
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/connection.c
>+++ postgresql-7.2.1/src/interfaces/odbc/connection.c
>@@ -105,7 +105,7 @@
> 
> 	ci = &conn->connInfo;
> 
>-	make_string(szDSN, cbDSN, ci->dsn);
>+	make_string(szDSN, cbDSN, ci->dsn, sizeof(ci->dsn));
> 
> 	/* get the values for the DSN from the registry */
> 	getDSNinfo(ci, CONN_OVERWRITE);
>@@ -117,8 +117,8 @@
> 	 * override values from DSN info with UID and authStr(pwd) This only
> 	 * occurs if the values are actually there.
> 	 */
>-	make_string(szUID, cbUID, ci->username);
>-	make_string(szAuthStr, cbAuthStr, ci->password);
>+	make_string(szUID, cbUID, ci->username,sizeof(ci->username));
>+	make_string(szAuthStr, cbAuthStr, ci->password, sizeof(ci->password));
> 
> 	/* fill in any defaults */
> 	getDSNdefaults(ci);
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/drvconn.c
>+++ postgresql-7.2.1/src/interfaces/odbc/drvconn.c
>@@ -91,7 +91,7 @@
> 		return SQL_INVALID_HANDLE;
> 	}
> 
>-	make_string(szConnStrIn, cbConnStrIn, connStrIn);
>+	make_string(szConnStrIn, cbConnStrIn, connStrIn, sizeof(connStrIn));
> 
> 	mylog("**** PGAPI_DriverConnect: fDriverCompletion=%d, connStrIn='%s'\n", fDriverCompletion, connStrIn);
> 	qlog("conn=%u, PGAPI_DriverConnect( in)='%s', fDriverCompletion=%d\n", conn, connStrIn, fDriverCompletion);
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/misc.h
>+++ postgresql-7.2.1/src/interfaces/odbc/misc.h
>@@ -84,7 +84,7 @@
> void		remove_newlines(char *string);
> char	   *strncpy_null(char *dst, const char *src, int len);
> char	   *trim(char *string);
>-char	   *make_string(const char *s, int len, char *buf);
>+char	   *make_string(const char *s, int len, char *buf, int bufsize);
> char	   *my_strcat(char *buf, const char *fmt, const char *s, int len);
> 
> /* defines for return value of my_strcpy */
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/misc.c
>+++ postgresql-7.2.1/src/interfaces/odbc/misc.c
>@@ -222,12 +222,13 @@
> /*------
>  *	Create a null terminated string (handling the SQL_NTS thing):
>  *		1. If buf is supplied, place the string in there
>- *		   (assumes enough space) and return buf.
>- *		2. If buf is not supplied, malloc space and return this string
>+ *		   (at most bufsize-1 bytes) and return buf.
>+ *		2. If buf is not supplied, malloc space and return this string;
>+ *		   (buflen is ignored in this case).
>  *------
>  */
> char *
>-make_string(const char *s, int len, char *buf)
>+make_string(const char *s, int len, char *buf, int bufsize)
> {
> 	int			length;
> 	char	   *str;
>@@ -238,6 +239,8 @@
> 
> 		if (buf)
> 		{
>+			if(length >= bufsize)
>+				length = bufsize-1;
> 			strncpy_null(buf, s, length + 1);
> 			return buf;
> 		}
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/info.c
>+++ postgresql-7.2.1/src/interfaces/odbc/info.c
>@@ -1186,7 +1186,7 @@
> 	show_views = FALSE;
> 
> 	/* make_string mallocs memory */
>-	tableType = make_string(szTableType, cbTableType, NULL);
>+	tableType = make_string(szTableType, cbTableType, NULL, 0);
> 	if (tableType)
> 	{
> 		strcpy(table_types, tableType);
>@@ -2086,7 +2086,7 @@
> 	 * only use the table name... the owner should be redundant, and we
> 	 * never use qualifiers.
> 	 */
>-	table_name = make_string(szTableName, cbTableName, NULL);
>+	table_name = make_string(szTableName, cbTableName, NULL, 0);
> 	if (!table_name)
> 	{
> 		stmt->errormsg = "No table name passed to PGAPI_Statistics.";
>@@ -2524,7 +2524,7 @@
> 	tbl_stmt = (StatementClass *) htbl_stmt;
> 
> 	pktab[0] = '\0';
>-	make_string(szTableName, cbTableName, pktab);
>+	make_string(szTableName, cbTableName, pktab, sizeof(pktab));
> 	if (pktab[0] == '\0')
> 	{
> 		stmt->errormsg = "No Table specified to PGAPI_PrimaryKeys.";
>@@ -2978,8 +2978,8 @@
> 	pk_table_needed[0] = '\0';
> 	fk_table_needed[0] = '\0';
> 
>-	make_string(szPkTableName, cbPkTableName, pk_table_needed);
>-	make_string(szFkTableName, cbFkTableName, fk_table_needed);
>+	make_string(szPkTableName, cbPkTableName, pk_table_needed, sizeof(pk_table_needed));
>+	make_string(szFkTableName, cbFkTableName, fk_table_needed, sizeof(fk_table_needed));
> 
> #ifdef	MULTIBYTE
> 	pkey_text = fkey_text = pkt_text = fkt_text = NULL;
>only in patch2:
>--- postgresql-7.2.1.orig/src/interfaces/odbc/execute.c
>+++ postgresql-7.2.1/src/interfaces/odbc/execute.c
>@@ -95,7 +95,7 @@
> 	if (self->statement)
> 		free(self->statement);
> 
>-	self->statement = make_string(szSqlStr, cbSqlStr, NULL);
>+	self->statement = make_string(szSqlStr, cbSqlStr, NULL, 0);
> 	if (!self->statement)
> 	{
> 		self->errornumber = STMT_NO_MEMORY_ERROR;
>@@ -146,7 +146,7 @@
> 	 * keep a copy of the un-parametrized statement, in case they try to
> 	 * execute this statement again
> 	 */
>-	stmt->statement = make_string(szSqlStr, cbSqlStr, NULL);
>+	stmt->statement = make_string(szSqlStr, cbSqlStr, NULL, 0);
> 	if (!stmt->statement)
> 	{
> 		stmt->errornumber = STMT_NO_MEMORY_ERROR;
>@@ -575,7 +575,7 @@
> 
> 	mylog("%s: entering...cbSqlStrIn=%d\n", func, cbSqlStrIn);
> 
>-	ptr = (cbSqlStrIn == 0) ? "" : make_string(szSqlStrIn, cbSqlStrIn, NULL);
>+	ptr = (cbSqlStrIn == 0) ? "" : make_string(szSqlStrIn, cbSqlStrIn, NULL, 0);
> 	if (!ptr)
> 	{
> 		conn->errornumber = CONN_NO_MEMORY_ERROR;

Actions: View | Diff

Attachments on bug 55714: 19739 | 19838 | 19839 | 19840