Mark PQfn() unsafe and fix overrun in frontend LO interface.

When result_is_int is set to 0, PQfn() cannot validate that the
result fits in result_buf, so it will write data beyond the end of
the buffer when the server returns more data than requested.  Since
this function is insecurable and obsolete, add a warning to the top
of the pertinent documentation advising against its use.

The only in-tree caller of PQfn() is the frontend large object
interface.  To fix that, add a buf_size parameter to
pqFunctionCall3() that is used to protect against overruns, and use
it in a private version of PQfn() that also accepts a buf_size
parameter.

Reported-by: Yu Kunpeng <yu443940816@live.com>
Reported-by: Martin Heistermann <martin.heistermann@unibe.ch>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com>
Security: CVE-2026-6477
Backpatch-through: 14

diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index ab296b6f87b72d278bfdb4b4d04056405ab637cc..e6ced5270580b78e800688b886ea72a5f9c6cf9c 100644 (file)
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -6772,15 +6772,20 @@ int PQrequestCancel(PGconn *conn);
    to send simple function calls to the server.
   </para>
 
-  <tip>
+  <warning>
    <para>
-    This interface is somewhat obsolete, as one can achieve similar
+    This interface is unsafe and should not be used.  When
+    <parameter>result_is_int</parameter> is set to <literal>0</literal>,
+    <function>PQfn</function> may write data beyond the end of
+    <parameter>result_buf</parameter>, regardless of whether the buffer has
+    enough space for the requested number of bytes.  Furthermore, it is
+    obsolete, as one can achieve similar
     performance and greater functionality by setting up a prepared
     statement to define the function call.  Then, executing the statement
     with binary transmission of parameters and results substitutes for a
     fast-path function call.
    </para>
-  </tip>
+  </warning>
 
   <para>
    The function <function id="libpq-PQfn">PQfn</function><indexterm><primary>PQfn</primary></indexterm>

diff --git a/src/interfaces/libpq/fe-exec.c b/src/interfaces/libpq/fe-exec.c
index c39588c8eee49ddb364a5f96451ed8be612e2e70..1dcb97dc57dd21c35804583af2b9874936310048 100644 (file)
--- a/src/interfaces/libpq/fe-exec.c
+++ b/src/interfaces/libpq/fe-exec.c
@@ -2990,6 +2990,20 @@ PQfn(PGconn *conn,
         int result_is_int,
         const PQArgBlock *args,
         int nargs)
+{
+       return PQnfn(conn, fnid, result_buf, -1, result_len,
+                                result_is_int, args, nargs);
+}
+
+/*
+ * PQnfn
+ *             Private version of PQfn() with verification that returned data fits in
+ *             result_buf when result_is_int == 0.  Setting buf_size to -1 disables
+ *             this verification.
+ */
+PGresult *
+PQnfn(PGconn *conn, int fnid, int *result_buf, int buf_size, int *result_len,
+         int result_is_int, const PQArgBlock *args, int nargs)
 {
        *result_len = 0;
 
@@ -3018,7 +3032,7 @@ PQfn(PGconn *conn,
        }
 
        return pqFunctionCall3(conn, fnid,
-                                                  result_buf, result_len,
+                                                  result_buf, buf_size, result_len,
                                                   result_is_int,
                                                   args, nargs);
 }

diff --git a/src/interfaces/libpq/fe-lobj.c b/src/interfaces/libpq/fe-lobj.c
index c17585e38b78486cd40b38ce7d1e630a46ba12b6..dcac7ccf26dd95d3b518c2e588d24c341bd053f7 100644 (file)
--- a/src/interfaces/libpq/fe-lobj.c
+++ b/src/interfaces/libpq/fe-lobj.c
@@ -271,8 +271,8 @@ lo_read(PGconn *conn, int fd, char *buf, size_t len)
        argv[1].len = 4;
        argv[1].u.integer = (int) len;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_read,
-                          (void *) buf, &result_len, 0, argv, 2);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_read,
+                               (void *) buf, len, &result_len, 0, argv, 2);
        if (PQresultStatus(res) == PGRES_COMMAND_OK)
        {
                PQclear(res);
@@ -412,8 +412,8 @@ lo_lseek64(PGconn *conn, int fd, pg_int64 offset, int whence)
        argv[2].len = 4;
        argv[2].u.integer = whence;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_lseek64,
-                          (void *) &retval, &result_len, 0, argv, 3);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_lseek64,
+                               (void *) &retval, sizeof(retval), &result_len, 0, argv, 3);
        if (PQresultStatus(res) == PGRES_COMMAND_OK && result_len == 8)
        {
                PQclear(res);
@@ -566,8 +566,8 @@ lo_tell64(PGconn *conn, int fd)
        argv[0].len = 4;
        argv[0].u.integer = fd;
 
-       res = PQfn(conn, conn->lobjfuncs->fn_lo_tell64,
-                          (void *) &retval, &result_len, 0, argv, 1);
+       res = PQnfn(conn, conn->lobjfuncs->fn_lo_tell64,
+                               (void *) &retval, sizeof(retval), &result_len, 0, argv, 1);
        if (PQresultStatus(res) == PGRES_COMMAND_OK && result_len == 8)
        {
                PQclear(res);

diff --git a/src/interfaces/libpq/fe-protocol3.c b/src/interfaces/libpq/fe-protocol3.c
index 5a1cec0d7900d3f2eb567b152cc7d9ad1df84df8..db6fd71ad4d3dc815fad4a54bde7765cf2921821 100644 (file)
--- a/src/interfaces/libpq/fe-protocol3.c
+++ b/src/interfaces/libpq/fe-protocol3.c
@@ -2022,7 +2022,7 @@ pqEndcopy3(PGconn *conn)
  */
 PGresult *
 pqFunctionCall3(PGconn *conn, Oid fnid,
-                               int *result_buf, int *actual_result_len,
+                               int *result_buf, int buf_size, int *actual_result_len,
                                int result_is_int,
                                const PQArgBlock *args, int nargs)
 {
@@ -2156,6 +2156,17 @@ pqFunctionCall3(PGconn *conn, Oid fnid,
                                        }
                                        else
                                        {
+                                               /*
+                                                * If the server returned too much data for the
+                                                * buffer, something fishy is going on.  Abandon ship.
+                                                */
+                                               if (buf_size != -1 && *actual_result_len > buf_size)
+                                               {
+                                                       libpq_append_conn_error(conn, "server returned too much data");
+                                                       handleSyncLoss(conn, id, *actual_result_len);
+                                                       return pqPrepareAsyncResult(conn);
+                                               }
+
                                                if (pqGetnchar((char *) result_buf,
                                                                           *actual_result_len,
                                                                           conn))

diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index e7fa4e8008f1b3e28ca7813127bd49888f45e824..34369644763b9b34074a5e195db9953375008b29 100644 (file)
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -721,6 +721,9 @@ extern int  pqRowProcessor(PGconn *conn, const char **errmsgp);
 extern void pqCommandQueueAdvance(PGconn *conn, bool isReadyForQuery,
                                                                  bool gotSync);
 extern int     PQsendQueryContinue(PGconn *conn, const char *query);
+extern PGresult *PQnfn(PGconn *conn, int fnid, int *result_buf, int buf_size,
+                                          int *result_len, int result_is_int,
+                                          const PQArgBlock *args, int nargs);
 
 /* === in fe-protocol3.c === */
 
@@ -736,7 +739,8 @@ extern int  pqGetline3(PGconn *conn, char *s, int maxlen);
 extern int     pqGetlineAsync3(PGconn *conn, char *buffer, int bufsize);
 extern int     pqEndcopy3(PGconn *conn);
 extern PGresult *pqFunctionCall3(PGconn *conn, Oid fnid,
-                                                                int *result_buf, int *actual_result_len,
+                                                                int *result_buf, int buf_size,
+                                                                int *actual_result_len,
                                                                 int result_is_int,
                                                                 const PQArgBlock *args, int nargs);