← Back to branch summary

~ubuntu-branches/ubuntu/trusty/postgresql-9.3/trusty-security

« back to all changes in this revision

Viewing changes to src/interfaces/ecpg/ecpglib/data.c

  • Committer: Package Import Robot
  • Author(s): Martin Pitt
  • Date: 2015-10-08 15:42:16 UTC
  • mfrom: (1.2.3) (18.1.3 trusty-proposed)
  • Revision ID: package-import@ubuntu.com-20151008154216-zvhdaqznz9qf4rw2
Tags: 9.3.10-0ubuntu0.14.04
https://launchpad.net/bugs/1504132
* New upstream security/bug fix release: (LP: #1504132)
  - Guard against stack overflows in json parsing.
    If an application constructs PostgreSQL json or jsonb values from
    arbitrary user input, the application's users can reliably crash the
    PostgreSQL server, causing momentary denial of service.  (CVE-2015-5289)

  - Fix contrib/pgcrypto to detect and report too-short crypt() salts
    Certain invalid salt arguments crashed the server or disclosed a few
    bytes of server memory.  We have not ruled out the viability of attacks
    that arrange for presence of confidential information in the disclosed
    bytes, but they seem unlikely.  (CVE-2015-5288)

  - See release notes for details about other fixes.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/interfaces/ecpg/ecpglib/data.c
132
132
        int                     value_for_indicator = 0;
133
133
        long            log_offset;
134
134
 
 
135
        if (sqlca == NULL)
 
136
        {
 
137
                ecpg_raise(lineno, ECPG_OUT_OF_MEMORY,
 
138
                                   ECPG_SQLSTATE_ECPG_OUT_OF_MEMORY, NULL);
 
139
                return (false);
 
140
        }
 
141
 
135
142
        /*
136
143
         * If we are running in a regression test, do not log the offset variable,
137
144
         * it depends on the machine's alignment.
415
422
                                case ECPGt_bool:
416
423
                                        if (pval[0] == 'f' && pval[1] == '\0')
417
424
                                        {
418
 
                                                if (offset == sizeof(char))
419
 
                                                        *((char *) (var + offset * act_tuple)) = false;
420
 
                                                else if (offset == sizeof(int))
421
 
                                                        *((int *) (var + offset * act_tuple)) = false;
422
 
                                                else
423
 
                                                        ecpg_raise(lineno, ECPG_CONVERT_BOOL,
424
 
                                                                           ECPG_SQLSTATE_DATATYPE_MISMATCH,
425
 
                                                                           NULL);
 
425
                                                *((bool *) (var + offset * act_tuple)) = false;
426
426
                                                pval++;
427
427
                                                break;
428
428
                                        }
429
429
                                        else if (pval[0] == 't' && pval[1] == '\0')
430
430
                                        {
431
 
                                                if (offset == sizeof(char))
432
 
                                                        *((char *) (var + offset * act_tuple)) = true;
433
 
                                                else if (offset == sizeof(int))
434
 
                                                        *((int *) (var + offset * act_tuple)) = true;
435
 
                                                else
436
 
                                                        ecpg_raise(lineno, ECPG_CONVERT_BOOL,
437
 
                                                                           ECPG_SQLSTATE_DATATYPE_MISMATCH,
438
 
                                                                           NULL);
 
431
                                                *((bool *) (var + offset * act_tuple)) = true;
439
432
                                                pval++;
440
433
                                                break;
441
434
                                        }