Avoid possibly-unsafe use of Windows' FormatMessage() function.

Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash.  This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.

Noted and patched by Christian Ullrich.
Back-patch to all supported branches.

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index c91320f4968f4e81d9ee043393eb1197ac6f7222..ded862ae31fad52864832d740a1abcfbcd95c084 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1225,7 +1225,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
 {
    char        sysmsg[256];
 
-   if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+   if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                     FORMAT_MESSAGE_FROM_SYSTEM,
+                     NULL, r, 0,
                      sysmsg, sizeof(sysmsg), NULL) == 0)
        ereport(severity,
                (errmsg_internal("%s", errmsg),

diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c
index 697917d4a4763030d9cd695daa67eab6f28f2d72..ae3bae4c823ad1649f5d7d35b274a65376570b29 100644 (file)
--- a/src/backend/port/win32/socket.c
+++ b/src/backend/port/win32/socket.c
@@ -657,7 +657,9 @@ pgwin32_socket_strerror(int err)
    }
 
    ZeroMemory(&wserrbuf, sizeof(wserrbuf));
-   if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE,
+   if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                     FORMAT_MESSAGE_FROM_SYSTEM |
+                     FORMAT_MESSAGE_FROM_HMODULE,
                      handleDLL,
                      err,
                      MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),

diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index a5e3cd2229c09277d7e1a12e7f1e2f8e00f42257..b3c3a86edecf076c90dc5e17fdfc3c428798944d 100644 (file)
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -480,7 +480,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
 {
    char        sysmsg[256];
 
-   if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+   if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                     FORMAT_MESSAGE_FROM_SYSTEM,
+                     NULL, r, 0,
                      sysmsg, sizeof(sysmsg), NULL) == 0)
        printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x",
                          mprefix, (unsigned int) r);

diff --git a/src/port/dirmod.c b/src/port/dirmod.c
index fde9736f4a03d55b5f083f0d41e4f083a84462f4..d544555be5b4d45a5cb4072ebe684b2505c700d0 100644 (file)
--- a/src/port/dirmod.c
+++ b/src/port/dirmod.c
@@ -207,7 +207,9 @@ pgsymlink(const char *oldpath, const char *newpath)
        LPSTR       msg;
 
        errno = 0;
-       FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+       FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                     FORMAT_MESSAGE_IGNORE_INSERTS |
+                     FORMAT_MESSAGE_FROM_SYSTEM,
                      NULL, GetLastError(),
                      MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
                      (LPSTR) &msg, 0, NULL);
@@ -282,7 +284,9 @@ pgreadlink(const char *path, char *buf, size_t size)
        LPSTR       msg;
 
        errno = 0;
-       FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+       FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                     FORMAT_MESSAGE_IGNORE_INSERTS |
+                     FORMAT_MESSAGE_FROM_SYSTEM,
                      NULL, GetLastError(),
                      MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
                      (LPSTR) &msg, 0, NULL);