Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6e05b19

Browse files
anarazelanarazel
committed
Add pg_encoding_set_invalid()
There are cases where we cannot / do not want to error out for invalidly encoded input. In such cases it can be useful to replace e.g. an incomplete multi-byte characters with bytes that will trigger an error when getting validated as part of a larger string. Unfortunately, until now, for some encoding no such sequence existed. For those encodings this commit removes one previously accepted input combination - we consider that to be ok, as the chosen bytes are outside of the valid ranges for the encodings, we just previously failed to detect that. As we cannot add a new field to pg_wchar_table without breaking ABI, this is implemented "in-line" in the newly added function. Author: Noah Misch <[email protected]> Reviewed-by: Andres Freund <[email protected]> Backpatch-through: 13 Security: CVE-2025-1094
1 parent ef23624 commit 6e05b19

File tree

5 files changed

+117
-1
lines changed

5 files changed

+117
-1
lines changed

‎src/common/wchar.c

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,25 @@
1616
#include "utils/ascii.h"
1717

1818

19+
/*
20+
* In today's multibyte encodings other than UTF8, this two-byte sequence
21+
* ensures pg_encoding_mblen() == 2 && pg_encoding_verifymbstr() == 0.
22+
*
23+
* For historical reasons, several verifychar implementations opt to reject
24+
* this pair specifically. Byte pair range constraints, in encoding
25+
* originator documentation, always excluded this pair. No core conversion
26+
* could translate it. However, longstanding verifychar implementations
27+
* accepted any non-NUL byte. big5_to_euc_tw and big5_to_mic even translate
28+
* pairs not valid per encoding originator documentation. To avoid tightening
29+
* core or non-core conversions in a security patch, we sought this one pair.
30+
*
31+
* PQescapeString() historically used spaces for BYTE1; many other values
32+
* could suffice for BYTE1.
33+
*/
34+
#define NONUTF8_INVALID_BYTE0 (0x8d)
35+
#define NONUTF8_INVALID_BYTE1 (' ')
36+
37+
1938
/*
2039
* Operations on multi-byte encodings are driven by a table of helper
2140
* functions.
@@ -1526,6 +1545,11 @@ pg_big5_verifychar(const unsigned char *s, int len)
15261545
if (len < l)
15271546
return -1;
15281547

1548+
if (l == 2 &&
1549+
s[0] == NONUTF8_INVALID_BYTE0 &&
1550+
s[1] == NONUTF8_INVALID_BYTE1)
1551+
return -1;
1552+
15291553
while (--l > 0)
15301554
{
15311555
if (*++s == '\0')
@@ -1575,6 +1599,11 @@ pg_gbk_verifychar(const unsigned char *s, int len)
15751599
if (len < l)
15761600
return -1;
15771601

1602+
if (l == 2 &&
1603+
s[0] == NONUTF8_INVALID_BYTE0 &&
1604+
s[1] == NONUTF8_INVALID_BYTE1)
1605+
return -1;
1606+
15781607
while (--l > 0)
15791608
{
15801609
if (*++s == '\0')
@@ -1624,6 +1653,11 @@ pg_uhc_verifychar(const unsigned char *s, int len)
16241653
if (len < l)
16251654
return -1;
16261655

1656+
if (l == 2 &&
1657+
s[0] == NONUTF8_INVALID_BYTE0 &&
1658+
s[1] == NONUTF8_INVALID_BYTE1)
1659+
return -1;
1660+
16271661
while (--l > 0)
16281662
{
16291663
if (*++s == '\0')
@@ -2068,6 +2102,19 @@ pg_utf8_islegal(const unsigned char *source, int length)
20682102
}
20692103

20702104

2105+
/*
2106+
* Fills the provided buffer with two bytes such that:
2107+
* pg_encoding_mblen(dst) == 2 && pg_encoding_verifymbstr(dst) == 0
2108+
*/
2109+
void
2110+
pg_encoding_set_invalid(int encoding, char *dst)
2111+
{
2112+
Assert(pg_encoding_max_length(encoding) > 1);
2113+
2114+
dst[0] = (encoding == PG_UTF8 ? 0xc0 : NONUTF8_INVALID_BYTE0);
2115+
dst[1] = NONUTF8_INVALID_BYTE1;
2116+
}
2117+
20712118
/*
20722119
*-------------------------------------------------------------------
20732120
* encoding info table
@@ -2190,5 +2237,11 @@ pg_encoding_max_length(int encoding)
21902237
{
21912238
Assert(PG_VALID_ENCODING(encoding));
21922239

2193-
return pg_wchar_table[encoding].maxmblen;
2240+
/*
2241+
* Check for the encoding despite the assert, due to some mingw versions
2242+
* otherwise issuing bogus warnings.
2243+
*/
2244+
return PG_VALID_ENCODING(encoding) ?
2245+
pg_wchar_table[encoding].maxmblen :
2246+
pg_wchar_table[PG_SQL_ASCII].maxmblen;
21942247
}

‎src/include/mb/pg_wchar.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,7 @@ extern int pg_valid_server_encoding_id(int encoding);
573573
* (in addition to the ones just above). The constant tables declared
574574
* earlier in this file are also available from libpgcommon.
575575
*/
576+
extern void pg_encoding_set_invalid(int encoding, char *dst);
576577
extern int pg_encoding_mblen(int encoding, const char *mbstr);
577578
extern int pg_encoding_mblen_bounded(int encoding, const char *mbstr);
578579
extern int pg_encoding_dsplen(int encoding, const char *mbstr);

‎src/test/regress/expected/conversion.out

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,13 @@
55
\getenv libdir PG_LIBDIR
66
\getenv dlsuffix PG_DLSUFFIX
77
\set regresslib :libdir '/regress' :dlsuffix
8+
CREATE FUNCTION test_enc_setup() RETURNS void
9+
AS :'regresslib', 'test_enc_setup'
10+
LANGUAGE C STRICT;
11+
SELECT FROM test_enc_setup();
12+
--
13+
(1 row)
14+
815
CREATE FUNCTION test_enc_conversion(bytea, name, name, bool, validlen OUT int, result OUT bytea)
916
AS :'regresslib', 'test_enc_conversion'
1017
LANGUAGE C STRICT;

‎src/test/regress/regress.c

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1105,6 +1105,56 @@ test_opclass_options_func(PG_FUNCTION_ARGS)
11051105
PG_RETURN_NULL();
11061106
}
11071107

1108+
/* one-time tests for encoding infrastructure */
1109+
PG_FUNCTION_INFO_V1(test_enc_setup);
1110+
Datum
1111+
test_enc_setup(PG_FUNCTION_ARGS)
1112+
{
1113+
/* Test pg_encoding_set_invalid() */
1114+
for (int i = 0; i < _PG_LAST_ENCODING_; i++)
1115+
{
1116+
char buf[2],
1117+
bigbuf[16];
1118+
int len,
1119+
mblen,
1120+
valid;
1121+
1122+
if (pg_encoding_max_length(i) == 1)
1123+
continue;
1124+
pg_encoding_set_invalid(i, buf);
1125+
len = strnlen(buf, 2);
1126+
if (len != 2)
1127+
elog(WARNING,
1128+
"official invalid string for encoding \"%s\" has length %d",
1129+
pg_enc2name_tbl[i].name, len);
1130+
mblen = pg_encoding_mblen(i, buf);
1131+
if (mblen != 2)
1132+
elog(WARNING,
1133+
"official invalid string for encoding \"%s\" has mblen %d",
1134+
pg_enc2name_tbl[i].name, mblen);
1135+
valid = pg_encoding_verifymbstr(i, buf, len);
1136+
if (valid != 0)
1137+
elog(WARNING,
1138+
"official invalid string for encoding \"%s\" has valid prefix of length %d",
1139+
pg_enc2name_tbl[i].name, valid);
1140+
valid = pg_encoding_verifymbstr(i, buf, 1);
1141+
if (valid != 0)
1142+
elog(WARNING,
1143+
"first byte of official invalid string for encoding \"%s\" has valid prefix of length %d",
1144+
pg_enc2name_tbl[i].name, valid);
1145+
memset(bigbuf, ' ', sizeof(bigbuf));
1146+
bigbuf[0] = buf[0];
1147+
bigbuf[1] = buf[1];
1148+
valid = pg_encoding_verifymbstr(i, bigbuf, sizeof(bigbuf));
1149+
if (valid != 0)
1150+
elog(WARNING,
1151+
"trailing data changed official invalid string for encoding \"%s\" to have valid prefix of length %d",
1152+
pg_enc2name_tbl[i].name, valid);
1153+
}
1154+
1155+
PG_RETURN_VOID();
1156+
}
1157+
11081158
/*
11091159
* Call an encoding conversion or verification function.
11101160
*

‎src/test/regress/sql/conversion.sql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
\set regresslib :libdir '/regress' :dlsuffix
1010

11+
CREATE FUNCTION test_enc_setup() RETURNS void
12+
AS :'regresslib', 'test_enc_setup'
13+
LANGUAGE C STRICT;
14+
SELECT FROM test_enc_setup();
15+
1116
CREATE FUNCTION test_enc_conversion(bytea, name, name, bool, validlen OUT int, result OUT bytea)
1217
AS :'regresslib', 'test_enc_conversion'
1318
LANGUAGE C STRICT;

0 commit comments

Comments
 (0)