Go to file
Noah Misch fd97bd411d Check return values of sensitive system library calls.
PostgreSQL already checked the vast majority of these, missing this
handful that nearly cannot fail.  If putenv() failed with ENOMEM in
pg_GSS_recvauth(), authentication would proceed with the wrong keytab
file.  If strftime() returned zero in cache_locale_time(), using the
unspecified buffer contents could lead to information exposure or a
crash.  Back-patch to 9.0 (all supported versions).

Other unchecked calls to these functions, especially those in frontend
code, pose negligible security concern.  This patch does not address
them.  Nonetheless, it is always better to check return values whose
specification provides for indicating an error.

In passing, fix an off-by-one error in strftime_win32()'s invocation of
WideCharToMultiByte().  Upon retrieving a value of exactly MAX_L10N_DATA
bytes, strftime_win32() would overrun the caller's buffer by one byte.
MAX_L10N_DATA is chosen to exceed the length of every possible value, so
the vulnerable scenario probably does not arise.

Security: CVE-2015-3166
2015-05-18 10:02:31 -04:00
config fix escaping of brackets for m4 broken in b6b2149e48 2015-05-03 09:37:15 -04:00
contrib Use += not = to set makefile variables after including base makefiles. 2015-05-17 20:04:42 -04:00
doc Put back stats-collector restarting code, removed accidentally. 2015-05-18 10:20:30 +03:00
src Check return values of sensitive system library calls. 2015-05-18 10:02:31 -04:00
.dir-locals.el emacs: Set indent-tabs-mode in perl-mode 2015-04-12 23:53:23 -04:00
.gitattributes Add functions for dealing with PGP armor header lines to pgcrypto. 2014-10-01 16:03:39 +03:00
.gitignore Improve speed of make check-world 2015-04-23 08:59:52 -04:00
aclocal.m4 Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
configure fix escaping of brackets for m4 broken in b6b2149e48 2015-05-03 09:37:15 -04:00
configure.in Windows also needs an override of the shared libpython detection 2015-05-02 13:23:16 -04:00
COPYRIGHT Update copyright for 2015 2015-01-06 11:43:47 -05:00
GNUmakefile.in Fix distclean/maintainer-clean targets to remove top-level tmp_install dir. 2015-05-13 18:48:05 -04:00
HISTORY Improve text of stub HISTORY file. 2014-02-12 18:16:17 -05:00
Makefile Allow make check in PL directories 2011-02-15 06:52:12 +02:00
README Don't generate plain-text HISTORY and src/test/regress/README anymore. 2014-02-10 20:48:04 -05:00
README.git Don't generate plain-text HISTORY and src/test/regress/README anymore. 2014-02-10 20:48:04 -05:00

PostgreSQL Database Management System
=====================================

This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains C language bindings.

PostgreSQL has many language interfaces, many of which are listed here:

	http://www.postgresql.org/download

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
http://www.postgresql.org/download/.  For more information look at our
web site located at http://www.postgresql.org/.