Fix bug in SET SESSION AUTHORIZATION that allows unprivileged users to crash

the server, if it has been compiled with Asserts enabled (CVE-2006-0553).
Thanks to Akio Ishida for reporting this problem.

diff --git a/src/backend/commands/variable.c b/src/backend/commands/variable.c
index 30173e4cabd83840375a68a6efeca7b19f253682..b1d970b9ab06dbbe2e9c7a439eb1b120a85454f1 100644 (file)
--- a/src/backend/commands/variable.c
+++ b/src/backend/commands/variable.c
@@ -9,7 +9,7 @@
  *
  *
  * IDENTIFICATION
- *       $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.105.4.2 2005/08/08 23:39:14 tgl Exp $
+ *       $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.105.4.3 2006/02/12 22:33:14 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -619,7 +619,9 @@ assign_client_encoding(const char *value, bool doit, GucSource source)
  * by the numeric userid, followed by a comma, followed by the user name.
  * This cannot be confused with a plain user name because of the NAMEDATALEN
  * limit on names, so we can tell whether we're being passed an initial
- * username or a saved/restored value.
+ * username or a saved/restored value.  (NOTE: we rely on guc.c to have
+ * properly truncated any incoming value, but not to truncate already-stored
+ * values.  See GUC_IS_NAME processing.)
  */
 extern char *session_authorization_string;             /* in guc.c */
 

diff --git a/src/backend/utils/mb/encnames.c b/src/backend/utils/mb/encnames.c
index 0c28438630b429ef648db7dde6723cbfddae1567..555231f7c10fb6ef1e3cded6185d53aeefc9e9dc 100644 (file)
--- a/src/backend/utils/mb/encnames.c
+++ b/src/backend/utils/mb/encnames.c
@@ -2,7 +2,7 @@
  * Encoding names and routines for work with it. All
  * in this file is shared bedween FE and BE.
  *
- * $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.22 2004/12/04 18:19:31 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/utils/mb/encnames.c,v 1.22.4.1 2006/02/12 22:33:14 tgl Exp $
  */
 #ifdef FRONTEND
 #include "postgres_fe.h"
@@ -434,7 +434,7 @@ pg_char_to_encname_struct(const char *name)
        if (name == NULL || *name == '\0')
                return NULL;
 
-       if (strlen(name) > NAMEDATALEN)
+       if (strlen(name) >= NAMEDATALEN)
        {
 #ifdef FRONTEND
                fprintf(stderr, "encoding name too long\n");

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index dc4d290ebc3a2a0479e69ca49cef27c116216355..c1fa6fc5686f6e48027f5fba40c9beb6c97ecabb 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -10,7 +10,7 @@
  * Written by Peter Eisentraut <peter_e@gmx.net>.
  *
  * IDENTIFICATION
- *       $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.252.4.2 2005/10/20 20:06:03 tgl Exp $
+ *       $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.252.4.3 2006/02/12 22:33:14 tgl Exp $
  *
  *--------------------------------------------------------------------
  */
@@ -44,6 +44,7 @@
 #include "optimizer/prep.h"
 #include "parser/parse_expr.h"
 #include "parser/parse_relation.h"
+#include "parser/scansup.h"
 #include "postmaster/bgwriter.h"
 #include "postmaster/syslogger.h"
 #include "postmaster/postmaster.h"
@@ -1426,7 +1427,7 @@ static struct config_string ConfigureNamesString[] =
                {"client_encoding", PGC_USERSET, CLIENT_CONN_LOCALE,
                        gettext_noop("Sets the client's character set encoding."),
                        NULL,
-                       GUC_REPORT
+                       GUC_IS_NAME | GUC_REPORT
                },
                &client_encoding_string,
                "SQL_ASCII", assign_client_encoding, NULL
@@ -1506,7 +1507,8 @@ static struct config_string ConfigureNamesString[] =
        {
                {"default_tablespace", PGC_USERSET, CLIENT_CONN_STATEMENT,
                        gettext_noop("Sets the default tablespace to create tables and indexes in."),
-                       gettext_noop("An empty string selects the database's default tablespace.")
+                       gettext_noop("An empty string selects the database's default tablespace."),
+                       GUC_IS_NAME
                },
                &default_tablespace,
                "", assign_default_tablespace, NULL
@@ -1646,7 +1648,7 @@ static struct config_string ConfigureNamesString[] =
                {"server_encoding", PGC_INTERNAL, CLIENT_CONN_LOCALE,
                        gettext_noop("Sets the server (database) character set encoding."),
                        NULL,
-                       GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+                       GUC_IS_NAME | GUC_REPORT | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
                },
                &server_encoding_string,
                "SQL_ASCII", NULL, NULL
@@ -1668,7 +1670,7 @@ static struct config_string ConfigureNamesString[] =
                {"session_authorization", PGC_USERSET, UNGROUPED,
                        gettext_noop("Sets the session user name."),
                        NULL,
-                       GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+                       GUC_IS_NAME | GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL | GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
                },
                &session_authorization_string,
                NULL, assign_session_authorization, show_session_authorization
@@ -3644,6 +3646,12 @@ set_config_option(const char *name, const char *value,
                                        newval = guc_strdup(elevel, value);
                                        if (newval == NULL)
                                                return false;
+                                       /*
+                                        * The only sort of "parsing" check we need to do is
+                                        * apply truncation if GUC_IS_NAME.
+                                        */
+                                       if (conf->gen.flags & GUC_IS_NAME)
+                                               truncate_identifier(newval, strlen(newval), true);
                                }
                                else if (conf->reset_val)
                                {

diff --git a/src/include/utils/guc_tables.h b/src/include/utils/guc_tables.h
index 39d2af3bab960d95ea7b9ce013c03d40c90b7bf1..4c26e10aaeef808bdb76a31d40a1c9393d676e6a 100644 (file)
--- a/src/include/utils/guc_tables.h
+++ b/src/include/utils/guc_tables.h
@@ -7,7 +7,7 @@
  *
  * Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
  *
- *       $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19 2004/12/31 22:03:46 pgsql Exp $
+ *       $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19.4.1 2006/02/12 22:33:14 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -125,6 +125,7 @@ struct config_generic
 #define GUC_DISALLOW_IN_FILE   0x0040  /* can't set in postgresql.conf */
 #define GUC_CUSTOM_PLACEHOLDER 0x0080  /* placeholder for custom variable */
 #define GUC_SUPERUSER_ONLY             0x0100  /* show only to superusers */
+#define GUC_IS_NAME                            0x0200  /* limit string to NAMEDATALEN-1 */
 
 /* bit values in status field */
 #define GUC_HAVE_TENTATIVE     0x0001          /* tentative value is defined */