Mark PQfn() unsafe and fix overrun in frontend LO interface.

When result_is_int is set to 0, PQfn() cannot validate that the
result fits in result_buf, so it will write data beyond the end of
the buffer when the server returns more data than requested.  Since
this function is insecurable and obsolete, add a warning to the top
of the pertinent documentation advising against its use.

The only in-tree caller of PQfn() is the frontend large object
interface.  To fix that, add a buf_size parameter to
pqFunctionCall3() that is used to protect against overruns, and use
it in a private version of PQfn() that also accepts a buf_size
parameter.

Reported-by: Yu Kunpeng <yu443940816@live.com>
Reported-by: Martin Heistermann <martin.heistermann@unibe.ch>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com>
Security: CVE-2026-6477
Backpatch-through: 14

diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index 487997f848f2271c798aabc3dee9b2e21d84a8af..7d3c3bb66d83393b1b8e9e947ca831cc9e294f08 100644 (file)
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -7058,15 +7058,20 @@ int PQrequestCancel(PGconn *conn);
    to send simple function calls to the server.
   </para>
 
-  <tip>
+  <warning>
    <para>
-    This interface is somewhat obsolete, as one can achieve similar
+    This interface is unsafe and should not be used.  When
+    <parameter>result_is_int</parameter> is set to <literal>0</literal>,
+    <function>PQfn</function> may write data beyond the end of
+    <parameter>result_buf</parameter>, regardless of whether the buffer has
+    enough space for the requested number of bytes.  Furthermore, it is
+    obsolete, as one can achieve similar
     performance and greater functionality by setting up a prepared
     statement to define the function call.  Then, executing the statement
     with binary transmission of parameters and results substitutes for a
     fast-path function call.
    </para>
-  </tip>
+  </warning>
 
   <para>
    The function <function id="libpq-PQfn">PQfn</function><indexterm><primary>PQfn</primary></indexterm>

diff --git a/src/interfaces/libpq/fe-exec.c b/src/interfaces/libpq/fe-exec.c
index 203d388bdbf2a8e7ef0d5b86fcb84cad0f7d3bb1..0dfd892df11827d8c1f205fd83e585cf37d6c1ad 100644 (file)
--- a/src/interfaces/libpq/fe-exec.c
+++ b/src/interfaces/libpq/fe-exec.c
@@ -3001,6 +3001,20 @@ PQfn(PGconn *conn,
         int result_is_int,
         const PQArgBlock *args,
         int nargs)
+{
+       return PQnfn(conn, fnid, result_buf, -1, result_len,
+                                result_is_int, args, nargs);
+}
+
+/*
+ * PQnfn
+ *             Private version of PQfn() with verification that returned data fits in
+ *             result_buf when result_is_int == 0.  Setting buf_size to -1 disables
+ *             this verification.
+ */
+PGresult *
+PQnfn(PGconn *conn, int fnid, int *result_buf, int buf_size, int *result_len,
+         int result_is_int, const PQArgBlock *args, int nargs)
 {
        *result_len = 0;
 
@@ -3029,7 +3043,7 @@ PQfn(PGconn *conn,
        }
 
        return pqFunctionCall3(conn, fnid,
-                                                  result_buf, result_len,
+                                                  result_buf, buf_size, result_len,
                                                   result_is_int,
                                                   args, nargs);
 }

diff --git a/src/interfaces/libpq/fe-lobj.c b/src/interfaces/libpq/fe-lobj.c
index 0c57e0d2de5f05b4ddb4c0ca4d5acc1043dc4cc2..12a32fcbaf37152caf228ef6c5bb478641ae4369 100644 (file)
--- a/src/interfaces/libpq/fe-lobj.c
+++ b/src/interfaces/libpq/fe-lobj.c
@@ -271,8 +271,8 @@ lo_read(PGconn *conn, int fd, char *buf, size_t len)
        argv[1].len = 4;
        argv[1].u.integer = (int) len;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_read,
-                          (void *) buf, &result_len, 0, argv, 2);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_read,
+                               (void *) buf, len, &result_len, 0, argv, 2);
        if (PQresultStatus(res) == PGRES_COMMAND_OK)
        {
                PQclear(res);
@@ -412,8 +412,8 @@ lo_lseek64(PGconn *conn, int fd, int64_t offset, int whence)
        argv[2].len = 4;
        argv[2].u.integer = whence;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_lseek64,
-                          (void *) &retval, &result_len, 0, argv, 3);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_lseek64,
+                               (void *) &retval, sizeof(retval), &result_len, 0, argv, 3);
        if (PQresultStatus(res) == PGRES_COMMAND_OK && result_len == 8)
        {
                PQclear(res);
@@ -566,8 +566,8 @@ lo_tell64(PGconn *conn, int fd)
        argv[0].len = 4;
        argv[0].u.integer = fd;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_tell64,
-                          (void *) &retval, &result_len, 0, argv, 1);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_tell64,
+                               (void *) &retval, sizeof(retval), &result_len, 0, argv, 1);
        if (PQresultStatus(res) == PGRES_COMMAND_OK && result_len == 8)
        {
                PQclear(res);

diff --git a/src/interfaces/libpq/fe-protocol3.c b/src/interfaces/libpq/fe-protocol3.c
index b0638bd3254840efdbe835d8cf950819ba8d1718..840e018cd18d95a0ef7dd846e8e0ce896bacf7f7 100644 (file)
--- a/src/interfaces/libpq/fe-protocol3.c
+++ b/src/interfaces/libpq/fe-protocol3.c
@@ -2204,7 +2204,7 @@ pqEndcopy3(PGconn *conn)
  */
 PGresult *
 pqFunctionCall3(PGconn *conn, Oid fnid,
-                               int *result_buf, int *actual_result_len,
+                               int *result_buf, int buf_size, int *actual_result_len,
                                int result_is_int,
                                const PQArgBlock *args, int nargs)
 {
@@ -2338,6 +2338,17 @@ pqFunctionCall3(PGconn *conn, Oid fnid,
                                        }
                                        else
                                        {
+                                               /*
+                                                * If the server returned too much data for the
+                                                * buffer, something fishy is going on.  Abandon ship.
+                                                */
+                                               if (buf_size != -1 && *actual_result_len > buf_size)
+                                               {
+                                                       libpq_append_conn_error(conn, "server returned too much data");
+                                                       handleFatalError(conn);
+                                                       return pqPrepareAsyncResult(conn);
+                                               }
+
                                                if (pqGetnchar(result_buf,
                                                                           *actual_result_len,
                                                                           conn))

diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 23de98290c9e2808d1b8eef083b891a117850176..cb038bf005726afa9517f9699c4fabda32323459 100644 (file)
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -762,6 +762,9 @@ extern int  pqRowProcessor(PGconn *conn, const char **errmsgp);
 extern void pqCommandQueueAdvance(PGconn *conn, bool isReadyForQuery,
                                                                  bool gotSync);
 extern int     PQsendQueryContinue(PGconn *conn, const char *query);
+extern PGresult *PQnfn(PGconn *conn, int fnid, int *result_buf, int buf_size,
+                                          int *result_len, int result_is_int,
+                                          const PQArgBlock *args, int nargs);
 
 /* === in fe-protocol3.c === */
 
@@ -777,7 +780,8 @@ extern int  pqGetline3(PGconn *conn, char *s, int maxlen);
 extern int     pqGetlineAsync3(PGconn *conn, char *buffer, int bufsize);
 extern int     pqEndcopy3(PGconn *conn);
 extern PGresult *pqFunctionCall3(PGconn *conn, Oid fnid,
-                                                                int *result_buf, int *actual_result_len,
+                                                                int *result_buf, int buf_size,
+                                                                int *actual_result_len,
                                                                 int result_is_int,
                                                                 const PQArgBlock *args, int nargs);