Re: [SECURITY] DoS attack on backend possible (was: Re:

Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:

> Justin Clift <justin(at)postgresql(dot)org> writes:
>> Am I understanding this right:
>> - A PostgreSQL 7.2.1 server can be crashed if it gets passed certain
>> date values which would be accepted by standard "front end" parsing?
>
> AFAIK it's a buffer overrun issue, so anything that looks like a
> reasonable date would *not* cause the problem.

Yes, but if you just check that the date given by the user matches the
regular expression "[0-9]+-[0-9]+-[0-9]+", it's still possible to
crash the backend.

--
Florian Weimer Weimer(at)CERT(dot)Uni-Stuttgart(dot)DE
University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT fax +49-711-685-5898