Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Bruce Momjian
OK, I have applied this to 7.2.X. I have applied the lpad/rpad/repeat patch to CVS head. I assume you do not want the others applied to CVS head because the fixes are already present. --- Neil Conway wrote: > Neil Conway

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Tom Lane
Neil Conway <[EMAIL PROTECTED]> writes: > Neil Conway <[EMAIL PROTECTED]> writes: >> Bruce Momjian <[EMAIL PROTECTED]> writes: > What would you like done with the patch you submitted? >> >> I'd like to see it applied to CVS HEAD and REL7_2_STABLE. > Uh, sorry -- wrote that without thinking. I'd

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Neil Conway
Neil Conway <[EMAIL PROTECTED]> writes: > Bruce Momjian <[EMAIL PROTECTED]> writes: > > What would you like done with the patch you submitted? > > I'd like to see it applied to CVS HEAD and REL7_2_STABLE. Uh, sorry -- wrote that without thinking. I'd like to see the patch applied to REL7_2_STABL

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Neil Conway
Bruce Momjian <[EMAIL PROTECTED]> writes: > What would you like done with the patch you submitted? I'd like to see it applied to CVS HEAD and REL7_2_STABLE. Cheers, Neil -- Neil Conway <[EMAIL PROTECTED]> || PGP Key ID: DB3C29FC ---(end of broadcast)-

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Bruce Momjian
What would you like done with the patch you submitted? --- Neil Conway wrote: > Bruce Momjian <[EMAIL PROTECTED]> writes: > > Tom Lane wrote: > > > Neil Conway <[EMAIL PROTECTED]> writes: > > > > The handling of the TZ envi

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Neil Conway
Bruce Momjian <[EMAIL PROTECTED]> writes: > Tom Lane wrote: > > Neil Conway <[EMAIL PROTECTED]> writes: > > > The handling of the TZ environmental variable is subject to a buffer > > > overrun. > > > > This problem is long gone in current sources, no? I quickly tested current sources, and it see

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Bruce Momjian
Tom Lane wrote: > Neil Conway <[EMAIL PROTECTED]> writes: > > The handling of the TZ environmental variable is subject to a buffer > > overrun. > > This problem is long gone in current sources, no? > The patch looks like it does prevent some problems. -- Bruce Momjian

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Tom Lane
Neil Conway <[EMAIL PROTECTED]> writes: > The handling of the TZ environmental variable is subject to a buffer > overrun. This problem is long gone in current sources, no? regards, tom lane ---(end of broadcast)--- TIP 3: i

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Bruce Momjian
Your patch has been added to the PostgreSQL unapplied patches list at: http://candle.pha.pa.us/cgi-bin/pgpatches I will try to apply it within the next 48 hours. --- Neil Conway wrote: > Neil Conway <[EMAIL PROTE

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Bruce Momjian
Your patch has been added to the PostgreSQL unapplied patches list at: http://candle.pha.pa.us/cgi-bin/pgpatches I will try to apply it within the next 48 hours. --- Neil Conway wrote: > Sir Mordred The Traitor <

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Neil Conway
Neil Conway <[EMAIL PROTECTED]> writes: > Sir Mordred The Traitor <[EMAIL PROTECTED]> writes: > > There exists a buffer overflow in a SET TIME ZONE command, that > > allows an attacker to execute malicious code. > > Here's a patch for the problem. I also fixed some other potential > buffer overru

Re: [HACKERS] @(#)Mordred Labs advisory 0x0002: Buffer overflow in PostgreSQL

2002-08-21 Thread Neil Conway
Sir Mordred The Traitor <[EMAIL PROTECTED]> writes: > There exists a buffer overflow in a SET TIME ZONE command, that > allows an attacker to execute malicious code. Here's a patch for the problem. I also fixed some other potential buffer overruns nearby, and added a little paranoia to another ro