Re: psql with GSS can crash - Mailing list pgsql-hackers

From Zdenek Kotala
Subject Re: psql with GSS can crash
Date
Msg-id 1267995452.2326.5.camel@localhost
Whole thread Raw
In response to Re: psql with GSS can crash  (Magnus Hagander <magnus@hagander.net>)
Responses Re: psql with GSS can crash
List pgsql-hackers
Magnus Hagander píše v po 01. 03. 2010 v 16:55 +0100:
> 2010/3/1 Zdenek Kotala <Zdenek.Kotala@sun.com>:
> > Magnus Hagander píše v čt 25. 02. 2010 v 15:17 +0100:
> >> On Thu, Feb 25, 2010 at 15:04, Zdenek Kotala <Zdenek.Kotala@sun.com> wrote:
> >> > Hi all,
> >> >
> >> > I got following stack:
> >> >
> >> >  fffffd7ffed14b70 strlen () + 40
> >> >  fffffd7ffed71665 snprintf () + e5
> >> >  fffffd7fff36d088 pg_GSS_startup () + 88
> >> >  fffffd7fff36d43a pg_fe_sendauth () + 15a
> >> >  fffffd7fff36e557 PQconnectPoll () + 3b7
> >> >  fffffd7fff36e152 connectDBComplete () + a2
> >> >  fffffd7fff36dc32 PQsetdbLogin () + 1b2
> >> >  000000000041e96d main () + 30d
> >> >  000000000041302c ???????? ()
> >> >
> >> > It seems that connection is not fully configured and krbsrvname or pghost is
> >> > not filled. Following code in fe-auth.c pg_GSS_startup() causes a crash:
> >> >
> >> >    440         maxlen = NI_MAXHOST + strlen(conn->krbsrvname) + 2;
> >> >    441         temp_gbuf.value = (char *) malloc(maxlen);
> >> >    442         snprintf(temp_gbuf.value, maxlen, "%s@%s",
> >> >    443                          conn->krbsrvname, conn->pghost);
> >> >    444         temp_gbuf.length = strlen(temp_gbuf.value);
> >> >
> >> > And following code in fe-connect.c fillPGconn() fill NULL value.
> >> >
> >> >    571         tmp = conninfo_getval(connOptions, "krbsrvname");
> >> >    572         conn->krbsrvname = tmp ? strdup(tmp) : NULL;
> >> >
> >> > I think that pg_GSS_startup should sanity the input.
> >>
> >> How did you get NULL in there? :-)
> >> There's a default set for that one that's PG_KRB_SRVNAM, so it really
> >> should never come out as NULL, I think...
> >
> > Yeah, you are right. conn->krbsrvname is "postgres" and conn->pghost is
> > null
> 
> Ah, good. We should defentd against that then.
> 
> 
> >> As for pghost, that certainly seems to be a bug. We check that one in
> >> krb5 and SSPI, but for some reason we seem to be missing it in GSSAPI.
> >
> > Yes. The check should be in GSSAPI too.
> >
> > However what I see in pg_hba.conf is following line:
> >
> > local   all         all                               gss
> >
> > Gss is used on local unix socket which probably cause a problem that
> > conn->pghost is not filled when psql tries to connect.
> 
> So there are really two errors - because we should disallow that.
> 
> See attached patch - can you confirm it removes the crash with just
> the client side applied, and then that it properly rejects GSS with
> the server side applied as well?

I tested it, but I cannot reproduce crash because I cannot setup illegal
combination now ;-). I think it is OK.
Thanks Zdenek




pgsql-hackers by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: incorrect exit code from psql with single transaction + violation of deferred FK constraint
Next
From: Tom Lane
Date:
Subject: Re: Re: incorrect exit code from psql with single transaction + violation of deferred FK constraint