Tom Lane e3208fec32 Prevent potential overruns of fixed-size buffers. ... Coverity identified a number of places in which it couldn't prove that a string being copied into a fixed-size buffer would fit. We believe that most, perhaps all of these are in fact safe, or are copying data that is coming from a trusted source so that any overrun is not really a security issue. Nonetheless it seems prudent to forestall any risk by using strlcpy() and similar functions. Fixes by Peter Eisentraut and Jozef Mlich based on Coverity reports. In addition, fix a potential null-pointer-dereference crash in contrib/chkpass. The crypt(3) function is defined to return NULL on failure, but chkpass.c didn't check for that before using the result. The main practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., "FIPS mode"). This ideally should've been a separate commit, but since it touches code adjacent to one of the buffer overrun changes, I included it in this commit to avoid last-minute merge issues. This issue was reported by Honza Horak. Security: CVE-2014-0065 for buffer overruns, CVE-2014-0066 for crypt()		2014-02-17 11:20:24 -05:00
..
access	Prevent potential overruns of fixed-size buffers.	2014-02-17 11:20:24 -05:00
bootstrap	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
catalog	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
commands	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
executor	Fix *-qualification of named parameters in SQL-language functions.	2014-02-03 14:46:54 -05:00
foreign	Arrange to cache FdwRoutine structs in foreign tables' relcache entries.	2013-03-06 23:48:09 -05:00
lib	Reset the binary heap in MergeAppend rescans.	2013-08-30 19:15:32 -04:00
libpq	Clear retry flags properly in replacement OpenSSL sock_write function.	2013-12-05 12:48:31 -05:00
main	Fix possible crashes due to using elog/ereport too early in startup.	2014-01-11 16:35:30 -05:00
nodes	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
optimizer	Fix bogus handling of "postponed" lateral quals.	2014-01-30 14:51:19 -05:00
parser	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
po	Translation updates	2013-12-02 00:09:43 -05:00
port	Fix unsafe references to errno within error messaging logic.	2014-01-29 20:04:01 -05:00
postmaster	Fix unportable coding in DetermineSleepTime().	2014-02-15 17:09:54 -05:00
regex	Fix regex match failures for backrefs combined with non-greedy quantifiers.	2013-07-18 21:22:43 -04:00
replication	Fix some more bugs in signal handlers and process shutdown logic.	2014-02-01 16:21:30 -05:00
rewrite	Fix breakage of MV column name list usage.	2013-11-04 14:45:18 -06:00
snowball	Update copyrights for 2013	2013-01-01 17:15:01 -05:00
storage	Clear MyProc and MyProcSignalState before they become invalid.	2014-01-31 21:34:44 -05:00
tcop	Avoid repeated name lookups during table and index DDL.	2014-02-17 09:33:32 -05:00
tsearch	Prevent potential overruns of fixed-size buffers.	2014-02-17 11:20:24 -05:00
utils	Prevent potential overruns of fixed-size buffers.	2014-02-17 11:20:24 -05:00
.gitignore	Add gitignore for mingw/cygwin build outputs	2011-06-09 18:11:47 +02:00
common.mk	Call check_keywords.pl in maintainer-check	2012-02-27 13:53:12 +02:00
Makefile	Move relpath() to libpgcommon	2013-02-21 22:46:17 -03:00
nls.mk	Add libpgcommon to backend gettext source files	2013-10-21 06:20:05 -04:00