Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 2111b40

Browse files
committed
Prevent buffer overrun in read_tablespace_map().
Robert Foggia of Trustwave reported that read_tablespace_map() fails to prevent an overrun of its on-stack input buffer. Since the tablespace map file is presumed trustworthy, this does not seem like an interesting security vulnerability, but still we should fix it just in the name of robustness. While here, document that pg_basebackup's --tablespace-mapping option doesn't work with tar-format output, because it doesn't. To make it work, we'd have to modify the tablespace_map file within the tarball sent by the server, which might be possible but I'm not volunteering. (Less-painful solutions would require changing the basebackup protocol so that the source server could adjust the map. That's not very appetizing either.)
1 parent b9ed856 commit 2111b40

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

doc/src/sgml/ref/pg_basebackup.sgml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,8 @@ PostgreSQL documentation
155155
the target directory. If the cluster contains additional
156156
tablespaces, the main data directory will be placed in the
157157
target directory, but all other tablespaces will be placed
158-
in the same absolute path as they have on the server.
158+
in the same absolute path as they have on the source server.
159+
(See <option>--tablespace-mapping</option> to change that.)
159160
</para>
160161
<para>
161162
This is the default format.
@@ -250,7 +251,12 @@ PostgreSQL documentation
250251
the main data directory are updated to point to the new location. So
251252
the new data directory is ready to be used for a new server instance
252253
with all tablespaces in the updated locations.
253-
</para>
254+
</para>
255+
256+
<para>
257+
Currently, this option only works with plain output format; it is
258+
ignored if tar format is selected.
259+
</para>
254260
</listitem>
255261
</varlistentry>
256262

src/backend/access/transam/xlog.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11485,7 +11485,7 @@ read_tablespace_map(List **tablespaces)
1148511485
}
1148611486
else if ((ch == '\n' || ch == '\r') && prev_ch == '\\')
1148711487
str[i - 1] = ch;
11488-
else
11488+
else if (i < sizeof(str) - 1)
1148911489
str[i++] = ch;
1149011490
prev_ch = ch;
1149111491
}

0 commit comments

Comments
 (0)