Prevent execution of enum_recv() from SQL.

tglsfdc · tglsfdc · commit aa27464b3405 · 2013-02-04T16:25:30.000-05:00
This function was misdeclared to take cstring when it should take internal. This at least allows crashing the server, and in principle an attacker might be able to use the function to examine the contents of server memory. The correct fix is to adjust the system catalog contents (and fix the regression tests that should have caught this but failed to). However, asking users to correct the catalog contents in existing installations is a pain, so as a band-aid fix for the back branches, install a check in enum_recv() to make it throw error if called with a cstring argument. We will later revert this in HEAD in favor of correcting the catalogs. Our thanks to Sumit Soni (via Secunia SVCRP) for reporting this issue. Security: CVE-2013-0255
diff --git a/doc/src/sgml/release-8.3.sgml b/doc/src/sgml/release-8.3.sgml
@@ -40,6 +40,19 @@
 
    <itemizedlist>
 
+    <listitem>
+     <para>
+      Prevent execution of <function>enum_recv</> from SQL (Tom Lane)
+     </para>
+
+     <para>
+      The function was misdeclared, allowing a simple SQL command to crash the
+      server.  In principle an attacker might be able to use it to examine the
+      contents of server memory.  Our thanks to Sumit Soni (via Secunia SVCRP)
+      for reporting this issue.  (CVE-2013-0255)
+     </para>
+    </listitem>
+
     <listitem>
      <para>
       Fix SQL grammar to allow subscripting or field selection from a
diff --git a/src/backend/utils/adt/enum.c b/src/backend/utils/adt/enum.c
@@ -14,6 +14,7 @@
 #include "postgres.h"
 
 #include "catalog/pg_enum.h"
+#include "catalog/pg_type.h"
 #include "fmgr.h"
 #include "utils/array.h"
 #include "utils/builtins.h"
@@ -99,6 +100,10 @@ enum_recv(PG_FUNCTION_ARGS)
 	char	   *name;
 	int			nbytes;
 
+	/* guard against pre-9.3 misdeclaration of enum_recv */
+	if (get_fn_expr_argtype(fcinfo->flinfo, 0) == CSTRINGOID)
+		elog(ERROR, "invalid argument for enum_recv");
+
 	name = pq_getmsgtext(buf, buf->len - buf->cursor, &nbytes);
 
 	/* must check length to prevent Assert failure within SearchSysCache */
