]> git.ipfire.org Git - thirdparty/postgresql.git/commit
projects / thirdparty / postgresql.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e6fcb03) | patch
Convert newlines to spaces in names written in pg_dump comments.
authorTom Lane <tgl@sss.pgh.pa.us>
Thu, 23 Feb 2012 20:53:17 +0000 (15:53 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Thu, 23 Feb 2012 20:53:17 +0000 (15:53 -0500)
commit2d2f63ddccc6a557e7eb35252483fea7fe4a688a
treef1741537ee702ed316be9009d48fb9fb62eac330tree | snapshot
parente6fcb03dc0de1771f7d408b5df1738272e6f98e5commit | diff
Convert newlines to spaces in names written in pg_dump comments.

pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script.  A name containing a newline
would at least render the script syntactically incorrect.  Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.

Reported by Heikki Linnakangas, patch by Robert Haas

Security: CVE-2012-0868
src/bin/pg_dump/pg_backup_archiver.c diff | blob | blame | history
Mirror of https://git.postgresql.org/git/postgresql.git