Make json{b}_populate_recordset() use the right tuple descriptor.
json{b}_populate_recordset() used the tuple descriptor created from the
query-level AS clause without worrying about whether it matched the actual
input record type. If it didn't, that would usually result in a crash,
though disclosure of server memory contents seems possible as well, for a
skilled attacker capable of issuing crafted SQL commands. Instead, use
the query-supplied descriptor only when there is no input tuple to look at,
and otherwise get a tuple descriptor based on the input tuple's own type
marking. The core code will detect any type mismatch in the latter case.
Michael Paquier and Tom Lane, per a report from David Rowley.
Back-patch to 9.3 where this functionality was introduced.
Security: CVE-2017-15098
Branch
------
REL9_6_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/38e825632be777a6ea4a39796e121c39728403b3
Modified Files
--------------
src/backend/utils/adt/jsonfuncs.c | 36 +++++++++++++++++++++++++-----------
src/test/regress/expected/json.out | 13 +++++++++++++
src/test/regress/expected/jsonb.out | 13 +++++++++++++
src/test/regress/sql/json.sql | 6 ++++++
src/test/regress/sql/jsonb.sql | 6 ++++++
5 files changed, 63 insertions(+), 11 deletions(-)
--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers
