Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 7abc157

Browse files
committed
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag, it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well. Otherwise, if the message contains any %n insertion markers, the function will try to fetch argument strings to substitute --- which we are not passing, possibly leading to a crash. This is exactly analogous to the rule about not giving printf() a format string you're not in control of. Noted and patched by Christian Ullrich. Back-patch to all supported branches.
1 parent 61d66c4 commit 7abc157

File tree

4 files changed

+15
-5
lines changed

4 files changed

+15
-5
lines changed

src/backend/libpq/auth.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -1011,7 +1011,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
10111011
{
10121012
char sysmsg[256];
10131013

1014-
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
1014+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
1015+
FORMAT_MESSAGE_FROM_SYSTEM,
1016+
NULL, r, 0,
10151017
sysmsg, sizeof(sysmsg), NULL) == 0)
10161018
ereport(severity,
10171019
(errmsg_internal("%s", errmsg),

src/backend/port/win32/socket.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,9 @@ pgwin32_socket_strerror(int err)
658658
}
659659

660660
ZeroMemory(&wserrbuf, sizeof(wserrbuf));
661-
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE,
661+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
662+
FORMAT_MESSAGE_FROM_SYSTEM |
663+
FORMAT_MESSAGE_FROM_HMODULE,
662664
handleDLL,
663665
err,
664666
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),

src/interfaces/libpq/fe-auth.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
234234
{
235235
char sysmsg[256];
236236

237-
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
237+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
238+
FORMAT_MESSAGE_FROM_SYSTEM,
239+
NULL, r, 0,
238240
sysmsg, sizeof(sysmsg), NULL) == 0)
239241
printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x\n",
240242
mprefix, (unsigned int) r);

src/port/dirmod.c

+6-2
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,9 @@ pgsymlink(const char *oldpath, const char *newpath)
206206
LPSTR msg;
207207

208208
errno = 0;
209-
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
209+
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
210+
FORMAT_MESSAGE_IGNORE_INSERTS |
211+
FORMAT_MESSAGE_FROM_SYSTEM,
210212
NULL, GetLastError(),
211213
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
212214
(LPSTR) &msg, 0, NULL);
@@ -281,7 +283,9 @@ pgreadlink(const char *path, char *buf, size_t size)
281283
LPSTR msg;
282284

283285
errno = 0;
284-
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
286+
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
287+
FORMAT_MESSAGE_IGNORE_INSERTS |
288+
FORMAT_MESSAGE_FROM_SYSTEM,
285289
NULL, GetLastError(),
286290
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
287291
(LPSTR) &msg, 0, NULL);

0 commit comments

Comments
 (0)