Avoid possibly-unsafe use of Windows' FormatMessage() function.

Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash.  This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.

Noted and patched by Christian Ullrich.
Back-patch to all supported branches.

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 7f1ae8c137af6351637f21e06801924e8533b7d4..899da712f7ad7ab609a4298460f0e0d8a8a50467 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -1011,7 +1011,9 @@ pg_SSPI_error(int severity, const char *errmsg, SECURITY_STATUS r)
 {
        char            sysmsg[256];
 
-       if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+       if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                                         FORMAT_MESSAGE_FROM_SYSTEM,
+                                         NULL, r, 0,
                                          sysmsg, sizeof(sysmsg), NULL) == 0)
                ereport(severity,
                                (errmsg_internal("%s", errmsg),

diff --git a/src/backend/port/win32/socket.c b/src/backend/port/win32/socket.c
index d1ea578b1f691af0ba40e4c1f122806cad68bb04..747304cee4295a67640c72cf1296a76b046a5e7e 100644 (file)
--- a/src/backend/port/win32/socket.c
+++ b/src/backend/port/win32/socket.c
@@ -658,7 +658,9 @@ pgwin32_socket_strerror(int err)
        }
 
        ZeroMemory(&wserrbuf, sizeof(wserrbuf));
-       if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_FROM_HMODULE,
+       if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                                         FORMAT_MESSAGE_FROM_SYSTEM |
+                                         FORMAT_MESSAGE_FROM_HMODULE,
                                          handleDLL,
                                          err,
                                          MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),

diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index cd863a5db1acab62c89f5505bc97894d3a743bb4..d23726215b7fcce5ab5b0412dbf81d5b8f5148b7 100644 (file)
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -234,7 +234,9 @@ pg_SSPI_error(PGconn *conn, const char *mprefix, SECURITY_STATUS r)
 {
        char            sysmsg[256];
 
-       if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, r, 0,
+       if (FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
+                                         FORMAT_MESSAGE_FROM_SYSTEM,
+                                         NULL, r, 0,
                                          sysmsg, sizeof(sysmsg), NULL) == 0)
                printfPQExpBuffer(&conn->errorMessage, "%s: SSPI error %x\n",
                                                  mprefix, (unsigned int) r);

diff --git a/src/port/dirmod.c b/src/port/dirmod.c
index 8053d16ebfd4273ec24eed1812f42ea168affa27..fe2b815ff6a3f0160b9b3668b2a4239686e86ff3 100644 (file)
--- a/src/port/dirmod.c
+++ b/src/port/dirmod.c
@@ -206,7 +206,9 @@ pgsymlink(const char *oldpath, const char *newpath)
                LPSTR           msg;
 
                errno = 0;
-               FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+               FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                                         FORMAT_MESSAGE_IGNORE_INSERTS |
+                                         FORMAT_MESSAGE_FROM_SYSTEM,
                                          NULL, GetLastError(),
                                          MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
                                          (LPSTR) &msg, 0, NULL);
@@ -281,7 +283,9 @@ pgreadlink(const char *path, char *buf, size_t size)
                LPSTR           msg;
 
                errno = 0;
-               FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
+               FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
+                                         FORMAT_MESSAGE_IGNORE_INSERTS |
+                                         FORMAT_MESSAGE_FROM_SYSTEM,
                                          NULL, GetLastError(),
                                          MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
                                          (LPSTR) &msg, 0, NULL);