Skip to content

fix postgresql: validate bit length in bitstring parser - #1346

Open
netliomax25-code wants to merge 1 commit into
userver-framework:developfrom
netliomax25-code:postgres-bitstring-bit-length
Open

fix postgresql: validate bit length in bitstring parser#1346
netliomax25-code wants to merge 1 commit into
userver-framework:developfrom
netliomax25-code:postgres-bitstring-bit-length

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. The bit/bit varying binary parser (BufferParser for BitStringRefWrapper in postgresql/include/userver/storages/postgres/io/bitstring.hpp) reads the field's bit-length prefix into an Integer (int32) directly from the server buffer, so bit_count is peer-controlled.
  2. It then computes the byte count as (bit_count + 7) / 8 before comparing against the remaining buffer length. For a value near INT_MAX this addition is signed overflow (undefined behavior, reported by the UBSan build), and a negative bit_count passes the length check and skips the read loop, so a malformed field is silently accepted as an empty bit string instead of being rejected.
  3. Reject bit_count < 0 up front and perform the ceil-division in size_t, so the value is validated before use and the addition cannot overflow. Parsing of valid lengths is unchanged, and both bit/bit varying and the Flags/bitset/array containers route through this parser.

Added a non-DB unit test that feeds a negative and an INT_MAX length prefix (both now throw InvalidBitStringRepresentation) plus a valid round-trip.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant