ltree: Fix overflows with lquery parsing

The lquery parser in contrib/ltree/ had two overflow problems:
- A single lquery level with many OR-separated variants (e.g.,
'label1|label2|...'), could cause an overflow of totallen, this being
stored as a uint16, meaning a maximum value of UINT16_MAX or 65k.  Each
variant contributes MAXALIGN(LVAR_HDRSIZE + len) bytes.  With enough
long variants, the value would wraparound.  This would corrupt the data
written by LQL_NEXT(), leading to a stack corruption, most likely
translating into a crash, but it would allow incorrect memory access.
- numvar, labelled as a uint16, counts the number of OR-variants in a
single level, and it is incremented without bounds checking.  With more
than PG_UINT16_MAX (65k) variants in a single level, and a minimum of
131kB of input data, it would wrap to 0.  When a (wildcard) '*' is
used, this would change the query results silently.

For both issues, a set of overflows checks are added to guard against
these problematic patterns.

The first issue has been reported by the three people listed below,
affecting v16 and newer versions due to b1665bf01e5f.  Its coding was
still unsafe in v14 and v15.  The second issue affects all the stable
branches; I have bumped into while reviewing the code of the module.

Reported-by: Vergissmeinnicht <vergissmeinnichtzh@gmail.com>
Reported-by: A1ex <alex000young@gmail.com>
Reported-by: Jihe Wang <wangjihe.mail@gmail.com>
Author: Michael Paquier <michael@paquier.xyz>
Security: CVE-2026-6473
Backpatch-through: 14

diff --git a/contrib/ltree/expected/ltree.out b/contrib/ltree/expected/ltree.out
index 28c321a4cf1c8e1e79a3027c2afec32614698aaf..02cce5d925a9713acbdfad28e8b8edb21bdcf2d9 100644 (file)
--- a/contrib/ltree/expected/ltree.out
+++ b/contrib/ltree/expected/ltree.out
@@ -8089,3 +8089,13 @@ SELECT count(*) FROM _ltreetest WHERE t ? '{23.*.1,23.*.2}' ;
     15
 (1 row)
 
+-- Test for overflow of lquery_level.totallen, based on an lquery level with
+-- many OR-variants.
+SELECT (repeat('x', 1000) || repeat('|' || repeat('x', 1000), 65))::lquery;
+ERROR:  label string is too long
+DETAIL:  Label length is 1000, must be at most 255, at character 1001.
+-- Test for overflow of lquery_level.numvar, with a set of single-char
+-- variants in one level.
+SELECT (repeat('a|', 65535) || 'a')::lquery;
+ERROR:  lquery level has too many variants
+DETAIL:  Number of variants exceeds the maximum allowed (65535).

diff --git a/contrib/ltree/ltree_io.c b/contrib/ltree/ltree_io.c
index 0a44a8c46915ab38ef8f52fba13f445276856c02..385db479540ffc7ad9e054075e6850e3ef57ec70 100644 (file)
--- a/contrib/ltree/ltree_io.c
+++ b/contrib/ltree/ltree_io.c
@@ -7,6 +7,7 @@
 
 #include <ctype.h>
 
+#include "common/int.h"
 #include "crc32.h"
 #include "libpq/pqformat.h"
 #include "ltree.h"
@@ -338,7 +339,12 @@ parse_lquery(const char *buf)
                                        lptr++;
                                        lptr->start = ptr;
                                        state = LQPRS_WAITDELIM;
-                                       curqlevel->numvar++;
+                                       if (pg_add_u16_overflow(curqlevel->numvar, 1, &curqlevel->numvar))
+                                               ereport(ERROR,
+                                                               (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                                                errmsg("lquery level has too many variants"),
+                                                                errdetail("Number of variants exceeds the maximum allowed (%d).",
+                                                                                  PG_UINT16_MAX)));
                                }
                                else
                                        UNCHAR;
@@ -530,7 +536,16 @@ parse_lquery(const char *buf)
                        lptr = GETVAR(curqlevel);
                        while (lptr - GETVAR(curqlevel) < curqlevel->numvar)
                        {
-                               cur->totallen += MAXALIGN(LVAR_HDRSIZE + lptr->len);
+                               int                     newlen = cur->totallen + MAXALIGN(LVAR_HDRSIZE + lptr->len);
+
+                               if (newlen > PG_UINT16_MAX)
+                                       ereport(ERROR,
+                                                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                                                        errmsg("lquery level is too large"),
+                                                        errdetail("Total size of level exceeds the maximum allowed (%d bytes).",
+                                                                          PG_UINT16_MAX)));
+                               cur->totallen = (uint16) newlen;
+
                                lrptr->len = lptr->len;
                                lrptr->flag = lptr->flag;
                                lrptr->val = ltree_crc32_sz(lptr->start, lptr->len);

diff --git a/contrib/ltree/sql/ltree.sql b/contrib/ltree/sql/ltree.sql
index 2a612e347de81b3e16f97a0b0ae1cffc2c5d6695..647f7f475f9b5f213e078969838c8f01c90c3d11 100644 (file)
--- a/contrib/ltree/sql/ltree.sql
+++ b/contrib/ltree/sql/ltree.sql
@@ -384,3 +384,11 @@ SELECT count(*) FROM _ltreetest WHERE t ~ '23.*{1}.1' ;
 SELECT count(*) FROM _ltreetest WHERE t ~ '23.*.1' ;
 SELECT count(*) FROM _ltreetest WHERE t ~ '23.*.2' ;
 SELECT count(*) FROM _ltreetest WHERE t ? '{23.*.1,23.*.2}' ;
+
+-- Test for overflow of lquery_level.totallen, based on an lquery level with
+-- many OR-variants.
+SELECT (repeat('x', 1000) || repeat('|' || repeat('x', 1000), 65))::lquery;
+
+-- Test for overflow of lquery_level.numvar, with a set of single-char
+-- variants in one level.
+SELECT (repeat('a|', 65535) || 'a')::lquery;