Skip to content

Commit 71627f3

Browse files
tglsfdctglsfdc
committed
Fix CVE-2013-0255 properly.
Revert commit ab0f7b6 (in HEAD only) in favor of the proper solution, which is to declare enum_recv() correctly in the system catalogs. It should be declared to take type "internal" not "cstring". Also improve the type_sanity regression test, which should have caught this typo, so that it actually would. Most of the relevant checks on the signature of type I/O functions should not have been restricted to basetypes/pseudotypes, as they should apply to any type's I/O functions.
1 parent 9728eda commit 71627f3

File tree

5 files changed

+22
-19
lines changed

5 files changed

+22
-19
lines changed

‎src/backend/utils/adt/enum.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
#include "access/htup_details.h"
1919
#include "catalog/indexing.h"
2020
#include "catalog/pg_enum.h"
21-
#include "catalog/pg_type.h"
2221
#include "libpq/pqformat.h"
2322
#include "utils/array.h"
2423
#include "utils/builtins.h"
@@ -105,10 +104,6 @@ enum_recv(PG_FUNCTION_ARGS)
105104
char *name;
106105
int nbytes;
107106

108-
/* guard against pre-9.3 misdeclaration of enum_recv */
109-
if (get_fn_expr_argtype(fcinfo->flinfo, 0) == CSTRINGOID)
110-
elog(ERROR, "invalid argument for enum_recv");
111-
112107
name = pq_getmsgtext(buf, buf->len - buf->cursor, &nbytes);
113108

114109
/* must check length to prevent Assert failure within SearchSysCache */

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 201301231
56+
#define CATALOG_VERSION_NO 201302131
5757

5858
#endif

‎src/include/catalog/pg_proc.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4160,7 +4160,7 @@ DATA(insert OID = 3530 ( enum_range PGNSP PGUID 12 1 0 0 0 f f f f f f s 2 0 22
41604160
DESCR("range between the two given enum values, as an ordered array");
41614161
DATA(insert OID = 3531 ( enum_range PGNSP PGUID 12 1 0 0 0 f f f f f f s 1 0 2277 "3500" _null_ _null_ _null_ _null_ enum_range_all _null_ _null_ _null_ ));
41624162
DESCR("range of the given enum type, as an ordered array");
4163-
DATA(insert OID = 3532 ( enum_recv PGNSP PGUID 12 1 0 0 0 f f f f t f s 2 0 3500 "2275 26" _null_ _null_ _null_ _null_ enum_recv _null_ _null_ _null_ ));
4163+
DATA(insert OID = 3532 ( enum_recv PGNSP PGUID 12 1 0 0 0 f f f f t f s 2 0 3500 "2281 26" _null_ _null_ _null_ _null_ enum_recv _null_ _null_ _null_ ));
41644164
DESCR("I/O");
41654165
DATA(insert OID = 3533 ( enum_send PGNSP PGUID 12 1 0 0 0 f f f f t f s 1 0 17 "3500" _null_ _null_ _null_ _null_ enum_send _null_ _null_ _null_ ));
41664166
DESCR("I/O");

‎src/test/regress/expected/type_sanity.out

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,10 @@ WHERE (p1.typinput = 0 OR p1.typoutput = 0);
117117
-- Check for bogus typinput routines
118118
SELECT p1.oid, p1.typname, p2.oid, p2.proname
119119
FROM pg_type AS p1, pg_proc AS p2
120-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
120+
WHERE p1.typinput = p2.oid AND NOT
121121
((p2.pronargs = 1 AND p2.proargtypes[0] = 'cstring'::regtype) OR
122+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'cstring'::regtype AND
123+
p2.proargtypes[1] = 'oid'::regtype) OR
122124
(p2.pronargs = 3 AND p2.proargtypes[0] = 'cstring'::regtype AND
123125
p2.proargtypes[1] = 'oid'::regtype AND
124126
p2.proargtypes[2] = 'int4'::regtype));
@@ -143,7 +145,7 @@ ORDER BY 1;
143145
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
144146
SELECT p1.oid, p1.typname, p2.oid, p2.proname
145147
FROM pg_type AS p1, pg_proc AS p2
146-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND
148+
WHERE p1.typinput = p2.oid AND
147149
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
148150
(p2.oid = 'array_in'::regproc)
149151
ORDER BY 1;
@@ -184,7 +186,7 @@ ORDER BY 1;
184186

185187
SELECT p1.oid, p1.typname, p2.oid, p2.proname
186188
FROM pg_type AS p1, pg_proc AS p2
187-
WHERE p1.typoutput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
189+
WHERE p1.typoutput = p2.oid AND NOT
188190
(p2.prorettype = 'cstring'::regtype AND NOT p2.proretset);
189191
oid | typname | oid | proname
190192
-----+---------+-----+---------
@@ -213,8 +215,10 @@ WHERE p1.typtype = 'd' AND p1.typoutput IS DISTINCT FROM p2.typoutput;
213215
-- Check for bogus typreceive routines
214216
SELECT p1.oid, p1.typname, p2.oid, p2.proname
215217
FROM pg_type AS p1, pg_proc AS p2
216-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND NOT
218+
WHERE p1.typreceive = p2.oid AND NOT
217219
((p2.pronargs = 1 AND p2.proargtypes[0] = 'internal'::regtype) OR
220+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'internal'::regtype AND
221+
p2.proargtypes[1] = 'oid'::regtype) OR
218222
(p2.pronargs = 3 AND p2.proargtypes[0] = 'internal'::regtype AND
219223
p2.proargtypes[1] = 'oid'::regtype AND
220224
p2.proargtypes[2] = 'int4'::regtype));
@@ -239,7 +243,7 @@ ORDER BY 1;
239243
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
240244
SELECT p1.oid, p1.typname, p2.oid, p2.proname
241245
FROM pg_type AS p1, pg_proc AS p2
242-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND
246+
WHERE p1.typreceive = p2.oid AND
243247
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
244248
(p2.oid = 'array_recv'::regproc)
245249
ORDER BY 1;
@@ -289,7 +293,7 @@ ORDER BY 1;
289293

290294
SELECT p1.oid, p1.typname, p2.oid, p2.proname
291295
FROM pg_type AS p1, pg_proc AS p2
292-
WHERE p1.typsend = p2.oid AND p1.typtype in ('b', 'p') AND NOT
296+
WHERE p1.typsend = p2.oid AND NOT
293297
(p2.prorettype = 'bytea'::regtype AND NOT p2.proretset);
294298
oid | typname | oid | proname
295299
-----+---------+-----+---------

‎src/test/regress/sql/type_sanity.sql

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,10 @@ WHERE (p1.typinput = 0 OR p1.typoutput = 0);
9696

9797
SELECT p1.oid, p1.typname, p2.oid, p2.proname
9898
FROM pg_type AS p1, pg_proc AS p2
99-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
99+
WHERE p1.typinput = p2.oid AND NOT
100100
((p2.pronargs = 1 AND p2.proargtypes[0] = 'cstring'::regtype) OR
101+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'cstring'::regtype AND
102+
p2.proargtypes[1] = 'oid'::regtype) OR
101103
(p2.pronargs = 3 AND p2.proargtypes[0] = 'cstring'::regtype AND
102104
p2.proargtypes[1] = 'oid'::regtype AND
103105
p2.proargtypes[2] = 'int4'::regtype));
@@ -115,7 +117,7 @@ ORDER BY 1;
115117
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
116118
SELECT p1.oid, p1.typname, p2.oid, p2.proname
117119
FROM pg_type AS p1, pg_proc AS p2
118-
WHERE p1.typinput = p2.oid AND p1.typtype in ('b', 'p') AND
120+
WHERE p1.typinput = p2.oid AND
119121
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
120122
(p2.oid = 'array_in'::regproc)
121123
ORDER BY 1;
@@ -141,7 +143,7 @@ ORDER BY 1;
141143

142144
SELECT p1.oid, p1.typname, p2.oid, p2.proname
143145
FROM pg_type AS p1, pg_proc AS p2
144-
WHERE p1.typoutput = p2.oid AND p1.typtype in ('b', 'p') AND NOT
146+
WHERE p1.typoutput = p2.oid AND NOT
145147
(p2.prorettype = 'cstring'::regtype AND NOT p2.proretset);
146148

147149
-- Composites, enums, ranges should all use the same output routines
@@ -159,8 +161,10 @@ WHERE p1.typtype = 'd' AND p1.typoutput IS DISTINCT FROM p2.typoutput;
159161

160162
SELECT p1.oid, p1.typname, p2.oid, p2.proname
161163
FROM pg_type AS p1, pg_proc AS p2
162-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND NOT
164+
WHERE p1.typreceive = p2.oid AND NOT
163165
((p2.pronargs = 1 AND p2.proargtypes[0] = 'internal'::regtype) OR
166+
(p2.pronargs = 2 AND p2.proargtypes[0] = 'internal'::regtype AND
167+
p2.proargtypes[1] = 'oid'::regtype) OR
164168
(p2.pronargs = 3 AND p2.proargtypes[0] = 'internal'::regtype AND
165169
p2.proargtypes[1] = 'oid'::regtype AND
166170
p2.proargtypes[2] = 'int4'::regtype));
@@ -178,7 +182,7 @@ ORDER BY 1;
178182
-- Exception as of 8.1: int2vector and oidvector have their own I/O routines
179183
SELECT p1.oid, p1.typname, p2.oid, p2.proname
180184
FROM pg_type AS p1, pg_proc AS p2
181-
WHERE p1.typreceive = p2.oid AND p1.typtype in ('b', 'p') AND
185+
WHERE p1.typreceive = p2.oid AND
182186
(p1.typelem != 0 AND p1.typlen < 0) AND NOT
183187
(p2.oid = 'array_recv'::regproc)
184188
ORDER BY 1;
@@ -210,7 +214,7 @@ ORDER BY 1;
210214

211215
SELECT p1.oid, p1.typname, p2.oid, p2.proname
212216
FROM pg_type AS p1, pg_proc AS p2
213-
WHERE p1.typsend = p2.oid AND p1.typtype in ('b', 'p') AND NOT
217+
WHERE p1.typsend = p2.oid AND NOT
214218
(p2.prorettype = 'bytea'::regtype AND NOT p2.proretset);
215219

216220
-- Composites, enums, ranges should all use the same send routines

0 commit comments

Comments
 (0)