Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit cb66f49

Browse files
committed
Fix misuse of memcpy() in check_ip().
The previous coding copied garbage into a local variable, pretty much ensuring that the intended test of an IPv6 connection address against a promoted IPv4 address from pg_hba.conf would never match. The lack of field complaints likely indicates that nobody realized this was supposed to work, which is unsurprising considering that no user-facing docs suggest it should work. In principle this could have led to a SIGSEGV due to reading off the end of memory, but since the source address would have pointed to somewhere in the function's stack frame, that's quite unlikely. What led to discovery of the bug is Hugo Osvaldo Barrera's report of a crash after an OS upgrade, which is probably because he is now running a system in which memcpy raises abort() upon detecting overlapping source and destination areas. (You'd have to additionally suppose some things about the stack frame layout to arrive at this conclusion, but it seems plausible.) This has been broken since the code was added, in commit f3aec2c, so back-patch to all supported branches.
1 parent c478959 commit cb66f49

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/backend/libpq/hba.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -700,8 +700,8 @@ check_ip(SockAddr *raddr, struct sockaddr * addr, struct sockaddr * mask)
700700
struct sockaddr_storage addrcopy,
701701
maskcopy;
702702

703-
memcpy(&addrcopy, &addr, sizeof(addrcopy));
704-
memcpy(&maskcopy, &mask, sizeof(maskcopy));
703+
memcpy(&addrcopy, addr, sizeof(addrcopy));
704+
memcpy(&maskcopy, mask, sizeof(maskcopy));
705705
pg_promote_v4_to_v6_addr(&addrcopy);
706706
pg_promote_v4_to_v6_mask(&maskcopy);
707707

0 commit comments

Comments
 (0)