pgsql: Prevent regexp back-refs from sometimes matching when they shoul

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Prevent regexp back-refs from sometimes matching when they shoul
Date: 2021-08-23 21:41:33
Message-ID: E1mIHhF-0002YH-Uh@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Prevent regexp back-refs from sometimes matching when they shouldn't.

The recursion in cdissect() was careless about clearing match data
for capturing parentheses after rejecting a partial match. This
could allow a later back-reference to succeed when by rights it
should fail for lack of a defined referent.

To fix, think a little more rigorously about what the contract
between different levels of cdissect's recursion needs to be.
With the right spec, we can fix this using fewer rather than more
resets of the match data; the key decision being that a failed
sub-match is now explicitly responsible for clearing any matches
it may have set.

There are enough other cross-checks and optimizations in the code
that it's not especially easy to exhibit this problem; usually, the
match will fail as-expected. Plus, regexps that are even potentially
vulnerable are most likely user errors, since there's just not much
point in writing a back-ref that doesn't always have a referent.
These facts perhaps explain why the issue hasn't been detected,
even though it's almost certainly a couple of decades old.

Discussion: https://postgr.es/m/151435.1629733387@sss.pgh.pa.us

Branch
------
REL9_6_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/d90e144148885767e2d0a82ccfef75480d39cb8d

Modified Files
--------------
src/backend/regex/regexec.c | 42 ++++++++++++++++++++++++++++++-------
src/test/regress/expected/regex.out | 13 ++++++++++++
src/test/regress/sql/regex.sql | 4 ++++
3 files changed, 51 insertions(+), 8 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Amit Kapila 2021-08-24 03:27:43 pgsql: Fix Alter Subscription's Add/Drop Publication behavior.
Previous Message Alvaro Herrera 2021-08-23 19:54:12 pgsql: Avoid creating archive status ".ready" files too early