Re: [BUGS] user authentication crash by Erik Luke (20-08-2001; - Mailing list pgsql-hackers

From Thomas Yackel
Subject Re: [BUGS] user authentication crash by Erik Luke (20-08-2001;
Date
Msg-id sbe07e58.037@gwsmtp.ohsu.edu
Whole thread Raw
List pgsql-hackers
A few clarifications so you have more to go on: 

to create the problem, we used the sql command with the "';" following the [CR] at the end of the typed characters as
shownhere:
 

alter user yyyyy with password 'xxxxxx
';

then we attempted to log in as that user from another users' local session using the psql -username=yyyyy command.

none of the users had a 'validuntil' date (it was null).  But setting one didn't help either.

we are using 7.1.3 on a solaris machine.  We noticed the problem when we examined the pg_pwd file and saw that the
validuntildate we entered was preceded what looked like an early line wrap.
 

I was quite surprised that such a small input error could cause the backend to shutdown.  Should psql remove [CR]s that
arecontained within ''? (at least for this command)?
 

Thanks for looking into this problem.

Tom

>>> Tom Lane <tgl@sss.pgh.pa.us> 10/31/01 21:43 PM >>>
"Thomas Yackel" <yackelt@ohsu.edu> writes:
> I got the error: "Bad abstime external representation ''" when attempted to start psql as a particular user and the
postmastershutdown.
 

> The problem, we discovered, is that this user had a carriage return contained within his password.  Changing the
passwordto remove the CR avoided the system shutdown.
 

Hmm.  I can see how a linefeed in a password would create a problem (it
breaks the line-oriented formatting of the pg_pwd file).  However, I
can't reproduce a postmaster crash here.  Either I'm not testing the
right combination of circumstances, or current sources are more robust
about this tha 7.1.  That's not unlikely given that Bruce rewrote the
password-file-parsing code a couple months ago.

In any case it seems like it'd be a good idea to forbid nonprinting
characters in passwords.  Comments anyone?
        regards, tom lane



pgsql-hackers by date:

Previous
From: "Marc G. Fournier"
Date:
Subject: Server going down for several hours ...
Next
From: "Tille, Andreas"
Date:
Subject: Re: Serious performance problem