]> git.ipfire.org Git - thirdparty/postgresql.git/commit
projects / thirdparty / postgresql.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 69cb7b9) | patch
Prevent a double free by not reentering be_tls_close().
authorNoah Misch <noah@leadboat.com>
Mon, 18 May 2015 14:02:31 +0000 (10:02 -0400)
committerNoah Misch <noah@leadboat.com>
Mon, 18 May 2015 14:02:38 +0000 (10:02 -0400)
commit648e41a6e480dae85a5aa0c90e36487c7f09a229
treeeb350f1298e30b3bcb0e4492a0aee4bc2ac03025tree | snapshot
parent69cb7b977bfddcdf7e14b93c550fa810eca4876bcommit | diff
Prevent a double free by not reentering be_tls_close().

Reentering this function with the right timing caused a double free,
typically crashing the backend.  By synchronizing a disconnection with
the authentication timeout, an unauthenticated attacker could achieve
this somewhat consistently.  Call be_tls_close() solely from within
proc_exit_prepare().  Back-patch to 9.0 (all supported versions).

Benkocs Norbert Attila

Security: CVE-2015-3165
src/backend/libpq/be-secure.c diff | blob | blame | history
src/backend/libpq/pqcomm.c diff | blob | blame | history
src/backend/postmaster/postmaster.c diff | blob | blame | history
Mirror of https://git.postgresql.org/git/postgresql.git