diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2016-03-29 11:54:57 -0400 |
| commit | 2fed676c937cdcdfafa72865308b84a7f273e730 (patch) | |
| tree | d14b3eb6da39fad4419c4a0406859f58359c8904 /src/port/dirmod.c | |
| parent | d77841d1cebd3514603af055f141a84c8e53cbd3 (diff) | |
Avoid possibly-unsafe use of Windows' FormatMessage() function.
Whenever this function is used with the FORMAT_MESSAGE_FROM_SYSTEM flag,
it's good practice to include FORMAT_MESSAGE_IGNORE_INSERTS as well.
Otherwise, if the message contains any %n insertion markers, the function
will try to fetch argument strings to substitute --- which we are not
passing, possibly leading to a crash. This is exactly analogous to the
rule about not giving printf() a format string you're not in control of.
Noted and patched by Christian Ullrich.
Back-patch to all supported branches.
Diffstat (limited to 'src/port/dirmod.c')
| -rw-r--r-- | src/port/dirmod.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/port/dirmod.c b/src/port/dirmod.c index c7fe97c40ff..9731857f6f5 100644 --- a/src/port/dirmod.c +++ b/src/port/dirmod.c @@ -206,7 +206,9 @@ pgsymlink(const char *oldpath, const char *newpath) LPSTR msg; errno = 0; - FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, + FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR) &msg, 0, NULL); @@ -281,7 +283,9 @@ pgreadlink(const char *path, char *buf, size_t size) LPSTR msg; errno = 0; - FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, + FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_IGNORE_INSERTS | + FORMAT_MESSAGE_FROM_SYSTEM, NULL, GetLastError(), MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR) &msg, 0, NULL); |