Bug 583690: (CVE-2010-2759) [SECURITY][PostgreSQL] Bugzilla crashes when viewing...

r=mkanat a=LpSolit

diff --git a/Bugzilla/Constants.pm b/Bugzilla/Constants.pm
index 1228d841d00a00a1b39cc78102e8a12e8c24bf4c..451a77e8483bfb8eebc05136c07a6c6a7c480781 100644 (file)
--- a/Bugzilla/Constants.pm
+++ b/Bugzilla/Constants.pm
@@ -150,6 +150,7 @@ use File::Basename;
 
     MIN_SMALLINT
     MAX_SMALLINT
+    MAX_INT_32
 
     MAX_LEN_QUERY_NAME
     MAX_CLASSIFICATION_SIZE
@@ -433,6 +434,7 @@ use constant ON_WINDOWS => ($^O =~ /MSWin32/i);
 
 use constant MIN_SMALLINT => -32768;
 use constant MAX_SMALLINT => 32767;
+use constant MAX_INT_32 => 2147483647;
 
 # The longest that a saved search name can be.
 use constant MAX_LEN_QUERY_NAME => 64;

diff --git a/Bugzilla/Object.pm b/Bugzilla/Object.pm
index 5a74996f1394c6b1d836ebf456db5ab19fc69edb..d9f4dd126cf265538e1d0a05d35f418aaee2bba9 100644 (file)
--- a/Bugzilla/Object.pm
+++ b/Bugzilla/Object.pm
@@ -76,6 +76,9 @@ sub _init {
           || ThrowCodeError('param_must_be_numeric',
                             {function => $class . '::_init'});
 
+        # Too large integers make PostgreSQL crash.
+        return if $id > MAX_INT_32;
+
         $object = $dbh->selectrow_hashref(qq{
             SELECT $columns FROM $table
              WHERE $id_field = ?}, undef, $id);
@@ -137,6 +140,8 @@ sub new_from_list {
         detaint_natural($id) ||
             ThrowCodeError('param_must_be_numeric',
                           {function => $class . '::new_from_list'});
+        # Too large integers make PostgreSQL crash.
+        next if $id > MAX_INT_32;
         push(@detainted_ids, $id);
     }
     # We don't do $invocant->match because some classes have

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 16d60c8e1410f209c331741bcd5bf69d8b61c99f..bafdf806f5d5b785e77b421228afd74122ecd31d 100644 (file)
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -255,8 +255,8 @@ sub get_attachment_link {
     my ($attachid, $link_text) = @_;
     my $dbh = Bugzilla->dbh;
 
-    detaint_natural($attachid)
-      || die "get_attachment_link() called with non-integer attachment number";
+    (detaint_natural($attachid) && $attachid <= MAX_INT_32)
+      || return $link_text;
 
     my ($bugid, $isobsolete, $desc) =
         $dbh->selectrow_array('SELECT bug_id, isobsolete, description
@@ -304,6 +304,7 @@ sub get_bug_link {
     }
     my $quote_bug_num = html_quote($bug_num);
     detaint_natural($bug_num) || return "&lt;invalid bug number: $quote_bug_num&gt;";
+    ($bug_num <= MAX_INT_32) || return $link_text;
 
     my ($bug_alias, $bug_state, $bug_res, $bug_desc) =
         $dbh->selectrow_array('SELECT bugs.alias, bugs.bug_status, bugs.resolution, bugs.short_desc