Re: @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

From: Neil Conway <neilc(at)samurai(dot)com>
To: Sir Mordred The Traitor <mordred(at)s-mail(dot)com>
Cc: pgsql-hackers(at)postgresql(dot)org
Subject: Re: @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL
Date: 2002-08-21 16:13:19
Message-ID: 87fzx8nqao.fsf@mailbox.samurai.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Sir Mordred The Traitor <mordred(at)s-mail(dot)com> writes:
> There exists a buffer overflow in a SET TIME ZONE command, that
> allows an attacker to execute malicious code.

Here's a patch for the problem. I also fixed some other potential
buffer overruns nearby, and added a little paranoia to another routine
that uses a statically sized buffer.

Thanks for the report.

Cheers,

Neil

--
Neil Conway <neilc(at)samurai(dot)com> || PGP Key ID: DB3C29FC

Attachment Content-Type Size
set_time_zone-3.patch text/x-patch 2.9 KB

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2002-08-21 16:18:41 Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
Previous Message Justin Clift 2002-08-21 16:13:08 Re: @(#)Mordred Labs advisory 0x0003: Buffer overflow in