Horton

Re: Unbounded %s in sscanf

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2021-06-28T14:02:46Z
Lists: pgsql-hackers 
Daniel Gustafsson <daniel@yesql.se> writes:
> I happened to spot the below call in src/bin/pg_basebackup/streamutil.c which
> has an unbounded %s in the format.

>     /* fetch xlog value and unit from the result */
>     if (sscanf(PQgetvalue(res, 0, 0), "%d%s", &xlog_val, xlog_unit) != 2)

> There is no risk of overflow as the unit is defined to be at most 2 characters,
> but that's not explained (like how a similar %s is handled in pg_dump).

Ugh.  Shouldn't we instead modify the format to read not more than
two characters?  Even if this is safe on non-malicious input, it
doesn't seem like good style.

			regards, tom lane

Commits

  1. Fix bug in TOC file error message printing

  2. Fix sscanf limits in pg_basebackup and pg_dump

  3. Fix sscanf limits in pg_dump