Skip to content

Commit adbb38f

Browse files
jackcjackc
committed
Do not allow protocol messages larger than ~1GB
The PostgreSQL server will reject messages greater than ~1 GB anyway. However, worse than that is that a message that is larger than 4 GB could wrap the 32-bit integer message size and be interpreted by the server as multiple messages. This could allow a malicious client to inject arbitrary protocol messages. GHSA-mrww-27vc-gghv
1 parent c1b0a01 commit adbb38f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+472
-390
lines changed

‎pgconn/pgconn.go‎

Lines changed: 41 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1674,25 +1674,55 @@ func (rr *ResultReader) concludeCommand(commandTag CommandTag, err error) {
16741674
// Batch is a collection of queries that can be sent to the PostgreSQL server in a single round-trip.
16751675
type Batch struct {
16761676
buf []byte
1677+
err error
16771678
}
16781679

16791680
// ExecParams appends an ExecParams command to the batch. See PgConn.ExecParams for parameter descriptions.
16801681
func (batch *Batch) ExecParams(sql string, paramValues [][]byte, paramOIDs []uint32, paramFormats []int16, resultFormats []int16) {
1681-
batch.buf = (&pgproto3.Parse{Query: sql, ParameterOIDs: paramOIDs}).Encode(batch.buf)
1682+
if batch.err != nil {
1683+
return
1684+
}
1685+
1686+
batch.buf, batch.err = (&pgproto3.Parse{Query: sql, ParameterOIDs: paramOIDs}).Encode(batch.buf)
1687+
if batch.err != nil {
1688+
return
1689+
}
16821690
batch.ExecPrepared("", paramValues, paramFormats, resultFormats)
16831691
}
16841692

16851693
// ExecPrepared appends an ExecPrepared e command to the batch. See PgConn.ExecPrepared for parameter descriptions.
16861694
func (batch *Batch) ExecPrepared(stmtName string, paramValues [][]byte, paramFormats []int16, resultFormats []int16) {
1687-
batch.buf = (&pgproto3.Bind{PreparedStatement: stmtName, ParameterFormatCodes: paramFormats, Parameters: paramValues, ResultFormatCodes: resultFormats}).Encode(batch.buf)
1688-
batch.buf = (&pgproto3.Describe{ObjectType: 'P'}).Encode(batch.buf)
1689-
batch.buf = (&pgproto3.Execute{}).Encode(batch.buf)
1695+
if batch.err != nil {
1696+
return
1697+
}
1698+
1699+
batch.buf, batch.err = (&pgproto3.Bind{PreparedStatement: stmtName, ParameterFormatCodes: paramFormats, Parameters: paramValues, ResultFormatCodes: resultFormats}).Encode(batch.buf)
1700+
if batch.err != nil {
1701+
return
1702+
}
1703+
1704+
batch.buf, batch.err = (&pgproto3.Describe{ObjectType: 'P'}).Encode(batch.buf)
1705+
if batch.err != nil {
1706+
return
1707+
}
1708+
1709+
batch.buf, batch.err = (&pgproto3.Execute{}).Encode(batch.buf)
1710+
if batch.err != nil {
1711+
return
1712+
}
16901713
}
16911714

16921715
// ExecBatch executes all the queries in batch in a single round-trip. Execution is implicitly transactional unless a
16931716
// transaction is already in progress or SQL contains transaction control statements. This is a simpler way of executing
16941717
// multiple queries in a single round trip than using pipeline mode.
16951718
func (pgConn *PgConn) ExecBatch(ctx context.Context, batch *Batch) *MultiResultReader {
1719+
if batch.err != nil {
1720+
return &MultiResultReader{
1721+
closed: true,
1722+
err: batch.err,
1723+
}
1724+
}
1725+
16961726
if err := pgConn.lock(); err != nil {
16971727
return &MultiResultReader{
16981728
closed: true,
@@ -1718,7 +1748,13 @@ func (pgConn *PgConn) ExecBatch(ctx context.Context, batch *Batch) *MultiResultR
17181748
pgConn.contextWatcher.Watch(ctx)
17191749
}
17201750

1721-
batch.buf = (&pgproto3.Sync{}).Encode(batch.buf)
1751+
batch.buf, batch.err = (&pgproto3.Sync{}).Encode(batch.buf)
1752+
if batch.err != nil {
1753+
multiResult.closed = true
1754+
multiResult.err = batch.err
1755+
pgConn.unlock()
1756+
return multiResult
1757+
}
17221758

17231759
pgConn.enterPotentialWriteReadDeadlock()
17241760
defer pgConn.exitPotentialWriteReadDeadlock()

‎pgconn/pgconn_test.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3363,9 +3363,9 @@ func TestSNISupport(t *testing.T) {
33633363
return
33643364
}
33653365

3366-
srv.Write((&pgproto3.AuthenticationOk{}).Encode(nil))
3367-
srv.Write((&pgproto3.BackendKeyData{ProcessID: 0, SecretKey: 0}).Encode(nil))
3368-
srv.Write((&pgproto3.ReadyForQuery{TxStatus: 'I'}).Encode(nil))
3366+
srv.Write(mustEncode((&pgproto3.AuthenticationOk{}).Encode(nil)))
3367+
srv.Write(mustEncode((&pgproto3.BackendKeyData{ProcessID: 0, SecretKey: 0}).Encode(nil)))
3368+
srv.Write(mustEncode((&pgproto3.ReadyForQuery{TxStatus: 'I'}).Encode(nil)))
33693369

33703370
serverSNINameChan <- sniHost
33713371
}()
@@ -3472,3 +3472,10 @@ func TestFatalErrorReceivedInPipelineMode(t *testing.T) {
34723472
err = pipeline.Close()
34733473
require.Error(t, err)
34743474
}
3475+
3476+
func mustEncode(buf []byte, err error) []byte {
3477+
if err != nil {
3478+
panic(err)
3479+
}
3480+
return buf
3481+
}

‎pgproto3/authentication_cleartext_password.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,10 @@ func (dst *AuthenticationCleartextPassword) Decode(src []byte) error {
3535
}
3636

3737
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
38-
func (src *AuthenticationCleartextPassword) Encode(dst []byte) []byte {
39-
dst = append(dst, 'R')
40-
dst = pgio.AppendInt32(dst, 8)
38+
func (src *AuthenticationCleartextPassword) Encode(dst []byte) ([]byte, error) {
39+
dst, sp := beginMessage(dst, 'R')
4140
dst = pgio.AppendUint32(dst, AuthTypeCleartextPassword)
42-
return dst
41+
return finishMessage(dst, sp)
4342
}
4443

4544
// MarshalJSON implements encoding/json.Marshaler.

‎pgproto3/authentication_gss.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,10 @@ func (a *AuthenticationGSS) Decode(src []byte) error {
2727
return nil
2828
}
2929

30-
func (a *AuthenticationGSS) Encode(dst []byte) []byte {
31-
dst = append(dst, 'R')
32-
dst = pgio.AppendInt32(dst, 4)
30+
func (a *AuthenticationGSS) Encode(dst []byte) ([]byte, error) {
31+
dst, sp := beginMessage(dst, 'R')
3332
dst = pgio.AppendUint32(dst, AuthTypeGSS)
34-
return dst
33+
return finishMessage(dst, sp)
3534
}
3635

3736
func (a *AuthenticationGSS) MarshalJSON() ([]byte, error) {

‎pgproto3/authentication_gss_continue.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,11 @@ func (a *AuthenticationGSSContinue) Decode(src []byte) error {
3131
return nil
3232
}
3333

34-
func (a *AuthenticationGSSContinue) Encode(dst []byte) []byte {
35-
dst = append(dst, 'R')
36-
dst = pgio.AppendInt32(dst, int32(len(a.Data))+8)
34+
func (a *AuthenticationGSSContinue) Encode(dst []byte) ([]byte, error) {
35+
dst, sp := beginMessage(dst, 'R')
3736
dst = pgio.AppendUint32(dst, AuthTypeGSSCont)
3837
dst = append(dst, a.Data...)
39-
return dst
38+
return finishMessage(dst, sp)
4039
}
4140

4241
func (a *AuthenticationGSSContinue) MarshalJSON() ([]byte, error) {

‎pgproto3/authentication_md5_password.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,11 @@ func (dst *AuthenticationMD5Password) Decode(src []byte) error {
3838
}
3939

4040
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
41-
func (src *AuthenticationMD5Password) Encode(dst []byte) []byte {
42-
dst = append(dst, 'R')
43-
dst = pgio.AppendInt32(dst, 12)
41+
func (src *AuthenticationMD5Password) Encode(dst []byte) ([]byte, error) {
42+
dst, sp := beginMessage(dst, 'R')
4443
dst = pgio.AppendUint32(dst, AuthTypeMD5Password)
4544
dst = append(dst, src.Salt[:]...)
46-
return dst
45+
return finishMessage(dst, sp)
4746
}
4847

4948
// MarshalJSON implements encoding/json.Marshaler.

‎pgproto3/authentication_ok.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,10 @@ func (dst *AuthenticationOk) Decode(src []byte) error {
3535
}
3636

3737
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
38-
func (src *AuthenticationOk) Encode(dst []byte) []byte {
39-
dst = append(dst, 'R')
40-
dst = pgio.AppendInt32(dst, 8)
38+
func (src *AuthenticationOk) Encode(dst []byte) ([]byte, error) {
39+
dst, sp := beginMessage(dst, 'R')
4140
dst = pgio.AppendUint32(dst, AuthTypeOk)
42-
return dst
41+
return finishMessage(dst, sp)
4342
}
4443

4544
// MarshalJSON implements encoding/json.Marshaler.

‎pgproto3/authentication_sasl.go‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,8 @@ func (dst *AuthenticationSASL) Decode(src []byte) error {
4747
}
4848

4949
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
50-
func (src *AuthenticationSASL) Encode(dst []byte) []byte {
51-
dst = append(dst, 'R')
52-
sp := len(dst)
53-
dst = pgio.AppendInt32(dst, -1)
50+
func (src *AuthenticationSASL) Encode(dst []byte) ([]byte, error) {
51+
dst, sp := beginMessage(dst, 'R')
5452
dst = pgio.AppendUint32(dst, AuthTypeSASL)
5553

5654
for _, s := range src.AuthMechanisms {
@@ -59,9 +57,7 @@ func (src *AuthenticationSASL) Encode(dst []byte) []byte {
5957
}
6058
dst = append(dst, 0)
6159

62-
pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
63-
64-
return dst
60+
return finishMessage(dst, sp)
6561
}
6662

6763
// MarshalJSON implements encoding/json.Marshaler.

‎pgproto3/authentication_sasl_continue.go‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,11 @@ func (dst *AuthenticationSASLContinue) Decode(src []byte) error {
3838
}
3939

4040
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
41-
func (src *AuthenticationSASLContinue) Encode(dst []byte) []byte {
42-
dst = append(dst, 'R')
43-
sp := len(dst)
44-
dst = pgio.AppendInt32(dst, -1)
41+
func (src *AuthenticationSASLContinue) Encode(dst []byte) ([]byte, error) {
42+
dst, sp := beginMessage(dst, 'R')
4543
dst = pgio.AppendUint32(dst, AuthTypeSASLContinue)
46-
4744
dst = append(dst, src.Data...)
48-
49-
pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
50-
51-
return dst
45+
return finishMessage(dst, sp)
5246
}
5347

5448
// MarshalJSON implements encoding/json.Marshaler.

‎pgproto3/authentication_sasl_final.go‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,11 @@ func (dst *AuthenticationSASLFinal) Decode(src []byte) error {
3838
}
3939

4040
// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
41-
func (src *AuthenticationSASLFinal) Encode(dst []byte) []byte {
42-
dst = append(dst, 'R')
43-
sp := len(dst)
44-
dst = pgio.AppendInt32(dst, -1)
41+
func (src *AuthenticationSASLFinal) Encode(dst []byte) ([]byte, error) {
42+
dst, sp := beginMessage(dst, 'R')
4543
dst = pgio.AppendUint32(dst, AuthTypeSASLFinal)
46-
4744
dst = append(dst, src.Data...)
48-
49-
pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
50-
51-
return dst
45+
return finishMessage(dst, sp)
5246
}
5347

5448
// MarshalJSON implements encoding/json.Unmarshaler.

0 commit comments

Comments
 (0)