Reject CancelRequestPacket having unexpected length. When the length was too short, the server read outside the allocation. That yielded the same log noise as sending the correct length with (backendPID,cancelAuthCode) matching nothing. Change to a message about the unexpected length. Given the attacker's lack of control over the memory layout and the general lack of diversity in memory layouts at the code in question, we doubt a would-be attacker could cause a segfault. Hence, while the report arrived via secur...@postgresql.org, this is not a vulnerability. Back-patch to v11 (all supported versions).
Andrey Borodin, reviewed by Tom Lane. Reported by Andrey Borodin. Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b152bb7b2724a7c62c2440c510af4926a996bbbc Modified Files -------------- src/backend/postmaster/postmaster.c | 7 +++++++ 1 file changed, 7 insertions(+)
