Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit f389b6e

Browse files
committed
Fix misparsing of empty value in conninfo_uri_parse_params().
After finding an "=" character, the pointer was advanced twice when it should only advance once. This is harmless as long as the value after "=" has at least one character; but if it doesn't, we'd miss the terminator character and include too much in the value. In principle this could lead to reading off the end of memory. It does not seem worth treating as a security issue though, because it would happen on client side, and besides client logic that's taking conninfo strings from untrusted sources has much worse security problems than this. Report and patch received off-list from Thomas Fanghaenel. Back-patch to 9.2 where the faulty code was introduced.
1 parent a196e67 commit f389b6e

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

src/interfaces/libpq/fe-connect.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4950,9 +4950,8 @@ conninfo_uri_parse_params(char *params,
49504950
++p;
49514951
break;
49524952
}
4953-
4954-
/* Advance, NUL is checked in the 'if' above */
4955-
++p;
4953+
else
4954+
++p; /* Advance over all other bytes. */
49564955
}
49574956

49584957
keyword = conninfo_uri_decode(keyword, errorMessage);

0 commit comments

Comments
 (0)