8000 Avoid possibly-unsafe use of Windows' FormatMessage() function. · dpirotte/postgres@6cd3029 · GitHub
[go: up one dir, main page]
Skip to content

Commit 6cd3029

Browse files
tglsfdctglsfdc
committed
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag, it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well. Otherwise, if the message contains any %n insertion markers, the function will try to fetch argument strings to substitute --- which we are not passing, possibly leading to a crash. This is exactly analogous to the rule about not giving printf() a format string you're not in control of. Noted and patched by Christian Ullrich. Back-patch to all supported branches.
1 parent 158a0fb commit 6cd3029

File tree

4 files changed

+15
-5
lines changed

4 files changed

+15
-5
lines changed

‎src/backend/libpq/auth.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1226,7 +1226,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
12261226
{
12271227
char sysmsg[256];
12281228

1229-
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
1229+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
1230+
FORMAT_MESSAGE_FROM_SYSTEM,
1231+
NULL, r, 0,
12301232
sysmsg, sizeof(sysmsg), NULL) == 0)
12311233
ereport(severity,
12321234
(errmsg_internal("%s", errmsg),

‎src/backend/port/win32/socket.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -656,7 +656,9 @@ pgwin32_socket_strerror(int err)
656656
}
657657

658658
ZeroMemory(&wserrbuf, sizeof(wserrbuf));
659-
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE,
659+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
660+
FORMAT_MESSAGE_FROM_SYSTEM |
661+
FORMAT_MESSAGE_FROM_HMODULE,
660662
handleDLL,
661663
err,
662664
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),

‎src/interfaces/libpq/fe-auth.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -480,7 +480,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
480480
{
481481
char sysmsg[256];
482482

483-
if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
483+
if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
484+
FORMAT_MESSAGE_FROM_SYSTEM,
485+
NULL, r, 0,
484486
sysmsg, sizeof(sysmsg), NULL) == 0)
485487
printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x",
486488
mprefix, (unsigned int) r);

‎src/port/dirmod.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,9 @@ pgsymlink(const char *oldpath, const char *newpath)
273273
LPSTR msg;
274274

275275
errno = 0;
276-
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
276+
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
277+
FORMAT_MESSAGE_IGNORE_INSERTS |
278+
FORMAT_MESSAGE_FROM_SYSTEM,
277279
NULL, GetLastError(),
278280
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
279281
(LPSTR) &msg, 0, NULL);
@@ -348,7 +350,9 @@ pgreadlink(const char *path, char *buf, size_t size)
348350
LPSTR msg;
349351

350352
errno = 0;
351-
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
353+
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
354+
FORMAT_MESSAGE_IGNORE_INSERTS |
355+
FORMAT_MESSAGE_FROM_SYSTEM,
352356
NULL, GetLastError(),
353357
MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
354358
(LPSTR) &msg, 0, NULL);

0 commit comments

Comments
 (0)
0