Make json{b}_populate_recordset() use the right tuple descriptor.
json{b}_populate_recordset() used the tuple descriptor created from the
query-level AS clause without worrying about whether it matched the actual
input record type. If it didn't, that would usually result in a crash,
though disclosure of server memory contents seems possible as well, for a
skilled attacker capable of issuing crafted SQL commands. Instead, use
the query-supplied descriptor only when there is no input tuple to look at,
and otherwise get a tuple descriptor based on the input tuple's own type
marking. The core code will detect any type mismatch in the latter case.
Michael Paquier and Tom Lane, per a report from David Rowley.
Back-patch to 9.3 where this functionality was introduced.
Security: CVE-2017-15098
Branch
------
REL9_3_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/c0c8807ded2f59c25b375998ef24ff09994563a1
Modified Files
--------------
src/backend/utils/adt/jsonfuncs.c | 58 ++++++++++++++++++++++++--------------
src/test/regress/expected/json.out | 13 +++++++++
src/test/regress/sql/json.sql | 5 ++++
3 files changed, 55 insertions(+), 21 deletions(-)
--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers
