lo_import does not check type before performing an import - Mailing list pgsql-bugs

From pgsql-bugs@postgresql.org
Subject lo_import does not check type before performing an import
Date
Msg-id 200104210056.f3L0uTu57093@hub.org
Whole thread Raw
Responses Re: lo_import does not check type before performing an import
List pgsql-bugs
Michael Richards (michael@fastmail.ca) reports a bug with a severity of 3
The lower the number the more severe it is.

Short Description
lo_import does not check type before performing an import

Long Description
lo_import within pgsql does not verify that it is reading from a file. You can import directories if you like and the
importeddata is a mess of ASCII. I didn't try it but I'm sure you could get into lots of trouble if you tried something
likelo_import('/dev/urandom') or some other device that you can read infinite amounts of data from. 

Sample Code
urdr=# insert into test values (lo_import('/home/miker/test'));
INSERT 6816303 1
urdr=# select * from test;
    t
---------
 6816289
(1 row)

> file /home/miker/test
/home/miker/test: directory


No file was uploaded with this report

pgsql-bugs by date:

Previous
From: pgsql-bugs@postgresql.org
Date:
Subject: SQL function lo_unlink is not documented
Next
From: Tom Lane
Date:
Subject: Re: lo_import does not check type before performing an import