Horton

Re: Improving psql's \password command

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Bossart, Nathan" <bossartn@amazon.com>
Cc: "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2021-11-15T21:03:53Z
Lists: pgsql-hackers 
"Bossart, Nathan" <bossartn@amazon.com> writes:
> On 11/15/21, 10:13 AM, "Tom Lane" <tgl@sss.pgh.pa.us> wrote:
>> * I don't believe that this bit is necessary, or if it is,
>> the comment fails to justify it:
>> 
>> -       initStringInfo(&buf);
>> +       /* make sure buf is palloc'd so we don't lose changes after a longjmp */
>> +       buf = makeStringInfo();

> My main worry was that buf->data might get repalloc'd via
> enlargeStringInfo(), which could cause problems after a longjmp.

So what?  That has nothing to do with whether the buf struct itself
is alloc'd or not.  Besides which, no longjmp is going to happen
during any reallocation.  I'm not entirely sure what scenario
you're worried about, but I don't see how alloc'ing the
StringInfoData struct would make it any safer.  If anything it'd
be less safe, since the StringInfoData is certain to be on the
stack, while a buf pointer variable is likely to be kept in a
register.  But really that doesn't matter anyhow, since this
is a stack level below where the sigsetjmp call is.  AFAIK the
only longjmp clobber risk is to pg_get_line_append's mutable
local variables, of which there are none.

			regards, tom lane

Commits

  1. pg_receivewal, pg_recvlogical: allow canceling initial password prompt.

  2. Allow psql's other uses of simple_prompt() to be interrupted by ^C.

  3. Provide a variant of simple_prompt() that can be interrupted by ^C.

  4. Make psql's \password default to CURRENT_USER, not PQuser(conn).