Horton

Re: Found a buffer-overflow defect in asynchronous database connection API PQconnectPoll

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Sudheer H R <sudheer.hr@tekenlight.com>
Cc: pgsql-bugs@lists.postgresql.org
Date: 2021-06-23T18:03:50Z
Lists: pgsql-bugs 
I wrote:
> Hmph.  I can't reproduce this on RHEL8: so far as I can tell, the string
> is physically null-terminated, and clang's address sanitizer doesn't
> complain either.  Still, given the vagueness of the spec for
> gss_display_status, it seems wise to not assume that every GSS
> implementation acts the same.

I've committed fixes to make our code rely on the returned length
field instead.  Hopefully that won't expose any new bugs in other
GSS implementations :-(

			regards, tom lane

Commits

  1. Don't assume GSSAPI result strings are null-terminated.